Edit tour

Windows Analysis Report
5q4psw.msi

Overview

General Information

Sample Name:	5q4psw.msi
Analysis ID:	878635
MD5:	e35727b10193fe55df216a1f9d166997
SHA1:	9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a
SHA256:	696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d
Tags:	msi
Infos:

Detection

Qbot

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Sample uses string decryption to hide its real strings

Potentially malicious time measurement code found

Queries the volume information (name, serial number etc) of a device

Yara signature match

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Connects to several IPs in different countries

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 6716 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\5q4psw.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 5660 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

rundll32.exe (PID: 3676 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 3920 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 6000 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

wscript.exe (PID: 7012 cmdline: wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "obama265", "Campaign": "1685436052", "Version": "404.1320", "C2 list": ["103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "94.207.104.225:443", "89.114.140.100:443", "213.64.33.61:2222", "86.176.144.234:2222", "72.134.124.16:443", "47.34.30.133:443", "109.50.149.241:2222", "85.104.105.67:443", "81.111.108.123:443", "86.173.2.12:2222", "188.28.19.84:443", "41.228.224.161:995", "12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.184.103.97:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.381770135.000000000360A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000002.381884570.0000000005230000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.4fb0000.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.4fb0000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.3620a00.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xdf71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9b97:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.3620a00.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.3620a00.0.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.3620a00.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.381770135.000000000360A000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "obama265", "Campaign": "1685436052", "Version": "404.1320", "C2 list": ["103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "94.207.104.225:443", "89.114.140.100:443", "213.64.33.61:2222", "86.176.144.234:2222", "72.134.124.16:443", "47.34.30.133:443", "109.50.149.241:2222", "85.104.105.67:443", "81.111.108.123:443", "86.173.2.12:2222", "188.28.19.84:443", "41.228.224.161:995", "12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.184.103.97:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078"]}

Sample uses string decryption to hide its real strings

Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: netstat -nao
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: runas
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ipconfig /all
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: net localgroup
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Microsoft
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELF_TEST_1
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: p%08x
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Self test FAILED!!!
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Self test OK.
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: /t5
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: whoami /all
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: cmd
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: route print
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .lnk
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: arp -a
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: net share
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: cmd.exe /c set
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Self check
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %u;%u;%u;
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ProfileImagePath
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ProgramData
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Self check ok!
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: powershell.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: qwinsta
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: net view
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Component_08
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Start screenshot
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: appidapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: c:\ProgramData
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Component_07
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: powershell.exe -encodedCommand
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: netstat -nao
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: runas
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ipconfig /all
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SystemRoot
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: cscript.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: C:\INTERNAL\__empty
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_PhysicalMemory
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ALLUSERSPROFILE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: image/jpeg
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: LocalLow
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: displayName
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: shlwapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CommandLine
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: kernel32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SubmitSamplesConsent
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: 1234567890
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wbj.go
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_DiskDrive
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: System32
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Name
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: WRSA.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: c:\\
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SpyNetReporting
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: FALSE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aswhookx.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Packages
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: application/x-shockwave-flash
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: RepUx.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Winsta0
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: avp.exe;kavtray.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: root\SecurityCenter2
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: MsMpEng.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: userenv.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: csc_ui.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: \\.\pipe\
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: pstorec.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: NTUSER.DAT
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: from
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: netapi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: gdi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: setupapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: iphlpapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CrAmTray.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_ComputerSystem
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: user32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: \sf2.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: egui.exe;ekrn.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Software\Microsoft
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %S.%06d
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: bcrypt.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wtsapi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: shell32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: TRUE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_Bios
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: c:\hiberfil.sysss
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: /
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ByteFence.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: type=0x%04X
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: snxhk_border_mywnd
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ROOT\CIMV2
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: https
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: fshoster32.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: kernelbase.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: regsvr32.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %s\system32\
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_Process
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: rundll32.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: LOCALAPPDATA
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: cmd.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: APPDATA
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: select
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: mcshield.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: advapi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ws2_32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .cfg
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_Product
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: WQL
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wininet.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: LastBootUpTime
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: urlmon.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Create
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_PnPEntity
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Initializing database...
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: winsta0\default
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .dat
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: WBJ_IGNORE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: next
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wpcap.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: image/pjpeg
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: fmon.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: vbs
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aswhooka.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SysWOW64
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: mpr.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: image/gif
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: crypt32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ntdll.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: open
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SystemRoot
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: cscript.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: C:\INTERNAL\__empty
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_PhysicalMemory
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ALLUSERSPROFILE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: image/jpeg
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: LocalLow
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: displayName
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: shlwapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CommandLine
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: kernel32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SubmitSamplesConsent
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: 1234567890
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wbj.go
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_DiskDrive
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: System32
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Name
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: WRSA.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: c:\\
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SpyNetReporting
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: FALSE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aswhookx.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Packages
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: application/x-shockwave-flash
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: RepUx.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Winsta0
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: avp.exe;kavtray.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: root\SecurityCenter2
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: MsMpEng.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: userenv.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: csc_ui.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: \\.\pipe\
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: pstorec.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: NTUSER.DAT
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: from
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: netapi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: gdi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: setupapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: iphlpapi.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CrAmTray.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_ComputerSystem
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: user32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: \sf2.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: egui.exe;ekrn.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Software\Microsoft
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %S.%06d
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: bcrypt.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wtsapi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: shell32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: TRUE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_Bios
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: c:\hiberfil.sysss
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: /
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ByteFence.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: type=0x%04X
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: snxhk_border_mywnd
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ROOT\CIMV2
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: https
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: fshoster32.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: kernelbase.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: regsvr32.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %s\system32\
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_Process
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: rundll32.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: LOCALAPPDATA
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: cmd.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: APPDATA
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: select
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: mcshield.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: advapi32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ws2_32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .cfg
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_Product
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: WQL
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wininet.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: LastBootUpTime
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: urlmon.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Create
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Win32_PnPEntity
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Initializing database...
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: winsta0\default
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: .dat
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: WBJ_IGNORE
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: next
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: wpcap.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: image/pjpeg
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: fmon.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: vbs
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: aswhooka.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: SysWOW64
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: mpr.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: image/gif
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: crypt32.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: ntdll.dll
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: open
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 4.2.rundll32.exe.4fb0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000C0B0 mv_cast5_crypt2,	4_2_1000C0B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B0D0 mv_camellia_crypt,	4_2_1000B0D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10013100 mv_encryption_init_info_alloc,mv_mallocz,mv_mallocz,mv_mallocz,mv_mallocz,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_calloc,	4_2_10013100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000C1B0 mv_cast5_crypt,	4_2_1000C1B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100132D0 mv_encryption_init_info_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,	4_2_100132D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002480 mv_aes_ctr_crypt,mv_aes_crypt,	4_2_10002480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10013480 mv_encryption_init_info_get_side_data,mv_encryption_init_info_alloc,mv_free,mv_free,mv_free,mv_free,mv_free,	4_2_10013480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100084B0 mv_blowfish_crypt,mv_blowfish_crypt_ecb,mv_blowfish_crypt_ecb,	4_2_100084B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10032510 mv_get_random_seed,BCryptOpenAlgorithmProvider,BCryptGenRandom,BCryptCloseAlgorithmProvider,mvpriv_open,_read,_close,mvpriv_open,_read,_close,clock,clock,mv_sha_init,mv_sha_update,mv_sha_final,mv_log,abort,	4_2_10032510
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002523 mv_aes_crypt,	4_2_10002523
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004D583 mv_twofish_crypt,	4_2_1004D583
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001363B mv_encryption_init_info_alloc,	4_2_1001363B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000867B mv_blowfish_crypt_ecb,	4_2_1000867B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100136FB mv_encryption_init_info_alloc,	4_2_100136FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10013860 mv_encryption_init_info_add_side_data,mv_malloc,mv_malloc,	4_2_10013860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004A990 mv_tea_crypt,	4_2_1004A990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100339C0 mv_rc4_crypt,	4_2_100339C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10012A70 mv_encryption_info_alloc,mv_mallocz,mv_mallocz,mv_mallocz,mv_calloc,mv_free,mv_free,mv_free,mv_free,	4_2_10012A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10012B40 mv_encryption_info_clone,mv_encryption_info_alloc,	4_2_10012B40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001BF0 mv_aes_crypt,	4_2_10001BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10012CF0 mv_encryption_info_free,mv_free,mv_free,mv_free,	4_2_10012CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10012D40 mv_encryption_info_get_side_data,mv_encryption_info_alloc,	4_2_10012D40

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 174.4.89.3:443
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 78.160.146.127:443
Source: Malware configuration extractor	IPs: 84.35.26.14:995
Source: Malware configuration extractor	IPs: 12.172.173.82:20
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 124.149.143.189:2222
Source: Malware configuration extractor	IPs: 70.160.67.203:443
Source: Malware configuration extractor	IPs: 186.64.67.30:443
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 94.207.104.225:443
Source: Malware configuration extractor	IPs: 89.114.140.100:443
Source: Malware configuration extractor	IPs: 213.64.33.61:2222
Source: Malware configuration extractor	IPs: 86.176.144.234:2222
Source: Malware configuration extractor	IPs: 72.134.124.16:443
Source: Malware configuration extractor	IPs: 47.34.30.133:443
Source: Malware configuration extractor	IPs: 109.50.149.241:2222
Source: Malware configuration extractor	IPs: 85.104.105.67:443
Source: Malware configuration extractor	IPs: 81.111.108.123:443
Source: Malware configuration extractor	IPs: 86.173.2.12:2222
Source: Malware configuration extractor	IPs: 188.28.19.84:443
Source: Malware configuration extractor	IPs: 41.228.224.161:995
Source: Malware configuration extractor	IPs: 12.172.173.82:50001
Source: Malware configuration extractor	IPs: 178.175.187.254:443
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 205.237.67.69:995
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 193.253.100.236:2222
Source: Malware configuration extractor	IPs: 27.0.48.233:443
Source: Malware configuration extractor	IPs: 102.159.188.125:443
Source: Malware configuration extractor	IPs: 71.38.155.217:443
Source: Malware configuration extractor	IPs: 58.186.75.42:443
Source: Malware configuration extractor	IPs: 76.178.148.107:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 51.14.29.227:2222
Source: Malware configuration extractor	IPs: 59.28.84.65:443
Source: Malware configuration extractor	IPs: 173.88.135.179:443
Source: Malware configuration extractor	IPs: 103.144.201.56:2078
Source: Malware configuration extractor	IPs: 96.87.28.170:2222
Source: Malware configuration extractor	IPs: 105.184.103.97:995
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 151.62.238.176:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 122.186.210.254:443
Source: Malware configuration extractor	IPs: 82.125.44.236:2222
Source: Malware configuration extractor	IPs: 84.108.200.161:443
Source: Malware configuration extractor	IPs: 76.16.49.134:443
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 76.170.252.153:995
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 78.92.133.215:443
Source: Malware configuration extractor	IPs: 50.68.204.71:993
Source: Malware configuration extractor	IPs: 186.75.95.6:443
Source: Malware configuration extractor	IPs: 113.11.92.30:443
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 98.145.23.67:443
Source: Malware configuration extractor	IPs: 85.57.212.13:3389
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 12.172.173.82:22
Source: Malware configuration extractor	IPs: 69.242.31.249:443
Source: Malware configuration extractor	IPs: 81.101.185.146:443
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 75.143.236.149:443
Source: Malware configuration extractor	IPs: 14.192.241.76:995
Source: Malware configuration extractor	IPs: 86.195.14.72:2222
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 220.240.164.182:443
Source: Malware configuration extractor	IPs: 73.29.92.128:443
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 96.56.197.26:2222
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 76.86.31.59:443
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 68.203.69.96:443
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 122.184.143.86:443
Source: Malware configuration extractor	IPs: 92.186.69.229:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2083
Source: Malware configuration extractor	IPs: 89.129.109.27:2222
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 151.65.167.77:443
Source: Malware configuration extractor	IPs: 86.132.236.117:443
Source: Malware configuration extractor	IPs: 92.154.17.149:2222
Source: Malware configuration extractor	IPs: 223.166.13.95:995
Source: Malware configuration extractor	IPs: 89.36.206.69:995
Source: Malware configuration extractor	IPs: 96.56.197.26:2083
Source: Malware configuration extractor	IPs: 78.18.105.11:443
Source: Malware configuration extractor	IPs: 82.127.153.75:2222
Source: Malware configuration extractor	IPs: 90.78.147.141:2222
Source: Malware configuration extractor	IPs: 82.131.141.209:443
Source: Malware configuration extractor	IPs: 183.87.163.165:443
Source: Malware configuration extractor	IPs: 92.9.45.20:2222
Source: Malware configuration extractor	IPs: 80.6.50.34:443
Source: Malware configuration extractor	IPs: 80.12.88.148:2222
Source: Malware configuration extractor	IPs: 69.133.162.35:443
Source: Malware configuration extractor	IPs: 172.115.17.50:443
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 103.140.174.20:2222
Source: Malware configuration extractor	IPs: 24.198.114.130:995
Source: Malware configuration extractor	IPs: 50.68.204.71:443
Source: Malware configuration extractor	IPs: 69.119.123.159:2222
Source: Malware configuration extractor	IPs: 64.121.161.102:443
Source: Malware configuration extractor	IPs: 2.82.8.80:443
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 70.112.206.5:443
Source: Malware configuration extractor	IPs: 198.2.51.242:993
Source: Malware configuration extractor	IPs: 2.36.64.159:2078
Source: Malware configuration extractor	IPs: 79.77.142.22:2222
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 147.219.4.194:443
Source: Malware configuration extractor	IPs: 116.74.164.81:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2078

Source: Joe Sandbox View	ASN Name: MEO-RESIDENCIALPT MEO-RESIDENCIALPT
Source: Joe Sandbox View	ASN Name: ASN-CXA-ALL-CCI-22773-RDCUS ASN-CXA-ALL-CCI-22773-RDCUS

Source: Joe Sandbox View	IP Address: 2.82.8.80 2.82.8.80
Source: Joe Sandbox View	IP Address: 70.160.67.203 70.160.67.203

Source: unknown

Network traffic detected: IP country count 30

Source: rundll32.exe, rundll32.exe, 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmp, main.dll.1.dr

String found in binary or memory: https://streams.videolan.org/upload/

Source: 4.2.rundll32.exe.4fb0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 4.2.rundll32.exe.3620a00.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 4.2.rundll32.exe.3620a00.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\55f8bc.msi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\55f8ba.msi

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000D060	4_2_1000D060
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B0D0	4_2_1000B0D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002F110	4_2_1002F110
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10008144	4_2_10008144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100101D0	4_2_100101D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001021B	4_2_1001021B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10007270	4_2_10007270
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002B270	4_2_1002B270
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004B2A5	4_2_1004B2A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10021340	4_2_10021340
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002C390	4_2_1002C390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004D3B0	4_2_1004D3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004E3E0	4_2_1004E3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002C428	4_2_1002C428
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10013480	4_2_10013480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000D4D0	4_2_1000D4D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004C500	4_2_1004C500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10025550	4_2_10025550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004D583	4_2_1004D583
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10028590	4_2_10028590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100105C0	4_2_100105C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004D5C1	4_2_1004D5C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000164B	4_2_1000164B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10027681	4_2_10027681
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10066691	4_2_10066691
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100556F8	4_2_100556F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10024700	4_2_10024700
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10030741	4_2_10030741
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10010750	4_2_10010750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000E760	4_2_1000E760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10021760	4_2_10021760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10010778	4_2_10010778
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000B830	4_2_1000B830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020830	4_2_10020830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10032890	4_2_10032890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100218A0	4_2_100218A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001900	4_2_10001900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000D910	4_2_1000D910
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10010980	4_2_10010980
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004A990	4_2_1004A990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001099C	4_2_1001099C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100499A0	4_2_100499A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000C9F0	4_2_1000C9F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004B9F7	4_2_1004B9F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000FA00	4_2_1000FA00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000AA10	4_2_1000AA10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10007A50	4_2_10007A50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001EAB0	4_2_1001EAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000EAC0	4_2_1000EAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000FAE0	4_2_1000FAE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000FAF7	4_2_1000FAF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020B00	4_2_10020B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000AB30	4_2_1000AB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003BA5	4_2_10003BA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000FBC0	4_2_1000FBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1004BBFB	4_2_1004BBFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001C10	4_2_10001C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000DC10	4_2_1000DC10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000EC10	4_2_1000EC10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000BC40	4_2_1000BC40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10004C96	4_2_10004C96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000ECC9	4_2_1000ECC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10027CE0	4_2_10027CE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002DCE0	4_2_1002DCE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000DD40	4_2_1000DD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000CD50	4_2_1000CD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10023D50	4_2_10023D50

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 100089C0 appears 34 times

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\5q4psw.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFCBDFB5D5B5D930C1.TMP

Jump to behavior

Source: classification engine

Classification label: mal96.troj.evad.winMSI@10/21@0/100

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{D493874E-EE16-481D-AB84-EC9562782202}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{D493874E-EE16-481D-AB84-EC9562782202}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{9984AE58-8694-4FF8-94E0-99EEEC2840AC}

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: main.dll.1.dr

Static PE information: real checksum: 0xe9e0f should be: 0xf51fe

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 6000 base: 313C50 value: E9 63 D7 FA 02

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 00000005.00000003.382004757.00000000036EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 00000005.00000003.382004757.00000000036EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 00000005.00000003.382004757.00000000036EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 00000005.00000003.382004757.00000000036EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 00000005.00000003.382004757.00000000036EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7076

Thread sleep count: 169 > 30

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10032510 rdtsc

4_2_10032510

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 0.1 %

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10032510 Start: 100327F5 End: 1003263E

4_2_10032510

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_10032510 rdtsc

4_2_10032510

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1002A9E9 mov eax, dword ptr fs:[00000030h]

4_2_1002A9E9

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 32F0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 32C0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 313C50	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 32C0000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 32F0000 protect: page read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Windows\SysWOW64\wermgr.exe base: 32C0000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1008B030 cpuid

4_2_1008B030

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1009E390 _errno,GetSystemTimeAsFileTime,GetSystemTimeAsFileTime,_errno,_errno,

4_2_1009E390

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1008F660 GetTimeZoneInformation,GetModuleHandleA,GetProcAddress,

4_2_1008F660

Source: rundll32.exe, 00000004.00000003.375089152.00000000052AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 00000004.00000003.375089152.00000000052AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: rundll32.exe, 00000004.00000003.375089152.00000000052AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: rundll32.exe, 00000004.00000003.375089152.00000000052AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 00000004.00000003.375089152.00000000052AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: rundll32.exe, 00000004.00000003.375089152.00000000052AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.rundll32.exe.4fb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3620a00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3620a00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.381770135.000000000360A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381884570.0000000005230000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.rundll32.exe.4fb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3620a00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3620a00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.381770135.000000000360A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.381884570.0000000005230000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	11 Scripting	1 DLL Side-Loading	311 Process Injection	11 Masquerading	1 Credential API Hooking	2 System Time Discovery	1 Replication Through Removable Media	1 Credential API Hooking	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Scripting	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5q4psw.msi	5%	ReversingLabs
5q4psw.msi	5%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll	4%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://streams.videolan.org/upload/	rundll32.exe, rundll32.exe, 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmp, main.dll.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.82.8.80	unknown	Portugal	3243	MEO-RESIDENCIALPT	true
70.160.67.203	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
75.143.236.149	unknown	United States	20115	CHARTER-20115US	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
86.195.14.72	unknown	France	3215	FranceTelecom-OrangeFR	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
105.184.103.97	unknown	South Africa	37457	Telkom-InternetZA	true
92.186.69.229	unknown	France	12479	UNI2-ASES	true
174.4.89.3	unknown	Canada	6327	SHAWCA	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
14.192.241.76	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
173.88.135.179	unknown	United States	10796	TWC-10796-MIDWESTUS	true
84.108.200.161	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	true
47.34.30.133	unknown	United States	20115	CHARTER-20115US	true
183.87.163.165	unknown	India	132220	JPRDIGITAL-INJPRDigitalPvtLtdIN	true
124.149.143.189	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
84.35.26.14	unknown	Netherlands	21221	INFOPACT-ASTheNetherlandsNL	true
73.29.92.128	unknown	United States	7922	COMCAST-7922US	true
68.203.69.96	unknown	United States	11427	TWC-11427-TEXASUS	true
82.131.141.209	unknown	Hungary	20845	DIGICABLEHU	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
178.175.187.254	unknown	Moldova Republic of	43289	TRABIAMD	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
186.64.67.30	unknown	Argentina	27953	NODOSUDSAAR	true
188.28.19.84	unknown	United Kingdom	206067	H3GUKGB	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
81.101.185.146	unknown	United Kingdom	5089	NTLGB	true
86.176.144.234	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
59.28.84.65	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
76.86.31.59	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
96.87.28.170	unknown	United States	7922	COMCAST-7922US	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
78.92.133.215	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
88.126.94.4	unknown	France	12322	PROXADFR	true
51.14.29.227	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
85.57.212.13	unknown	Spain	12479	UNI2-ASES	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
80.12.88.148	unknown	France	3215	FranceTelecom-OrangeFR	true
81.111.108.123	unknown	United Kingdom	5089	NTLGB	true
69.133.162.35	unknown	United States	11426	TWC-11426-CAROLINASUS	true
86.132.236.117	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
151.62.238.176	unknown	Italy	1267	ASN-WINDTREIUNETEU	true
70.112.206.5	unknown	United States	11427	TWC-11427-TEXASUS	true
41.228.224.161	unknown	Tunisia	37693	TUNISIANATN	true
205.237.67.69	unknown	Canada	11290	CC-3272CA	true
102.159.188.125	unknown	Tunisia	37705	TOPNETTN	true
151.65.167.77	unknown	Italy	1267	ASN-WINDTREIUNETEU	true
76.178.148.107	unknown	United States	10838	OCEANIC-INTERNET-RRUS	true
89.36.206.69	unknown	Italy	48544	TECNOADSL-ASIT	true
69.242.31.249	unknown	United States	7922	COMCAST-7922US	true
85.104.105.67	unknown	Turkey	9121	TTNETTR	true
94.207.104.225	unknown	United Arab Emirates	15802	DU-AS1AE	true
193.253.100.236	unknown	France	3215	FranceTelecom-OrangeFR	true
76.16.49.134	unknown	United States	7922	COMCAST-7922US	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
78.18.105.11	unknown	Ireland	2110	AS-BTIREBTIrelandwaspreviouslyknownasEsatNetEUnet	true
80.6.50.34	unknown	United Kingdom	5089	NTLGB	true
103.144.201.56	unknown	unknown	139762	MSSOLUTION-AS-APSolutionBD	true
27.0.48.233	unknown	India	132573	SAINGN-AS-INSAINGNNetworkServicesIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
98.145.23.67	unknown	United States	20001	TWC-20001-PACWESTUS	true
82.125.44.236	unknown	France	3215	FranceTelecom-OrangeFR	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
89.129.109.27	unknown	Spain	12479	UNI2-ASES	true
122.186.210.254	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
79.77.142.22	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	true
90.78.147.141	unknown	France	3215	FranceTelecom-OrangeFR	true
122.184.143.86	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
186.75.95.6	unknown	Panama	11556	CableWirelessPanamaPA	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
213.64.33.61	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
86.173.2.12	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
92.154.17.149	unknown	France	3215	FranceTelecom-OrangeFR	true
78.160.146.127	unknown	Turkey	9121	TTNETTR	true
58.186.75.42	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	true
223.166.13.95	unknown	China	17621	CNCGROUP-SHChinaUnicomShanghainetworkCN	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
50.68.204.71	unknown	Canada	6327	SHAWCA	true
71.38.155.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
220.240.164.182	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
24.198.114.130	unknown	United States	11351	TWC-11351-NORTHEASTUS	true
2.36.64.159	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
198.2.51.242	unknown	United States	20001	TWC-20001-PACWESTUS	true
92.9.45.20	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
113.11.92.30	unknown	Bangladesh	7565	BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD	true
109.50.149.241	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
69.119.123.159	unknown	United States	6128	CABLE-NET-1US	true
172.115.17.50	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.219.4.194	unknown	United States	1498	DNIC-ASBLK-01498-01499US	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	878635
Start date and time:	2023-05-30 22:58:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	5q4psw.msi
Detection:	MAL
Classification:	mal96.troj.evad.winMSI@10/21@0/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 4.6% (good quality ratio 2%) Quality average: 17.8% Quality standard deviation: 26.1%
HCA Information:	Successful, ratio: 67% Number of executed functions: 3 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:59:40	API Interceptor	9x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.82.8.80	15dasx.msi	Get hash	malicious	Qbot	Browse
	15dasx.msi	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	main2.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	graphically.dat.dll	Get hash	malicious	Qbot	Browse
	kxyj5.dat.dll	Get hash	malicious	Qbot	Browse
	PXNuYAPR.dat.dll	Get hash	malicious	Qbot	Browse
	TB9mkKe4Qzu.dat.dll	Get hash	malicious	Qbot	Browse
	leiotrichy.js	Get hash	malicious	Qbot	Browse
	a0UFMZnC6ltxphw.dat.dll	Get hash	malicious	Qbot	Browse
	msfilter.dll	Get hash	malicious	Qbot	Browse
	QPAWJ8VnpO.dll	Get hash	malicious	Qbot	Browse
	Cjpxxx.js	Get hash	malicious	Qbot	Browse
	analysis.dll	Get hash	malicious	Qbot	Browse
70.160.67.203	15dasx.msi	Get hash	malicious	Qbot	Browse
	15dasx.msi	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	main2.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	graphically.dat.dll	Get hash	malicious	Qbot	Browse
	43acf3.msi	Get hash	malicious	Qbot	Browse
	43acf3.msi	Get hash	malicious	Qbot	Browse
	666.dat.dll	Get hash	malicious	Qbot	Browse
	kxyj5.dat.dll	Get hash	malicious	Qbot	Browse
	PXNuYAPR.dat.dll	Get hash	malicious	Qbot	Browse
	TB9mkKe4Qzu.dat.dll	Get hash	malicious	Qbot	Browse
	a0UFMZnC6ltxphw.dat.dll	Get hash	malicious	Qbot	Browse
	808.dll	Get hash	malicious	Qbot	Browse
	808.dll	Get hash	malicious	Qbot	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MEO-RESIDENCIALPT	15dasx.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	15dasx.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	licking.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	licking.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	main2.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	r3zg12.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	main.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	r3zg12.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	main.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	graphically.dat.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	LEo7jDCX96.elf	Get hash	malicious	Mirai	Browse	2.81.219.243
	yvweY4vsVq.elf	Get hash	malicious	Mirai	Browse	188.81.116.228
	8C3RpG9eka.elf	Get hash	malicious	Mirai	Browse	85.244.28.246
	Pc8ewtsPRR.elf	Get hash	malicious	Mirai	Browse	85.240.179.8
	33cWz2DNq2.elf	Get hash	malicious	Mirai	Browse	2.83.183.198
	pu3jOk0Q9u.elf	Get hash	malicious	Mirai	Browse	82.155.117.104
	6mu5y2WWPK.elf	Get hash	malicious	Mirai	Browse	85.246.119.61
	A6BM2Ru5xc.elf	Get hash	malicious	Mirai	Browse	37.189.107.20
	43acf3.msi	Get hash	malicious	Qbot	Browse	188.83.251.100
ASN-CXA-ALL-CCI-22773-RDCUS	15dasx.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	15dasx.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	licking.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	licking.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	main2.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	r3zg12.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	main.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	r3zg12.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	main.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	graphically.dat.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	UMyY7qXi7b.elf	Get hash	malicious	Mirai	Browse	68.6.72.41
	udxyqUncDs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	184.188.248.242
	KipHfbWc5u.elf	Get hash	malicious	Mirai	Browse	174.74.5.188
	CT1zp877iP.elf	Get hash	malicious	Mirai	Browse	68.108.254.249
	65cBS6uCoV.elf	Get hash	malicious	Mirai	Browse	70.187.92.80
	gLeiWqaVuD.elf	Get hash	malicious	Mirai	Browse	24.249.120.101
	RW3fkwplaC.elf	Get hash	malicious	Mirai	Browse	70.171.100.214
	i12DwPGkzd.elf	Get hash	malicious	Mirai	Browse	68.101.71.203
	65iP0qrS2t.elf	Get hash	malicious	Mirai	Browse	68.107.216.55

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Config.Msi\55f8bb.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	8918
Entropy (8bit):	5.573518641830586
Encrypted:	false
SSDEEP:	96:FrM2eKeCyGS2U/yyPw9CsvRqnU/yyPw9C6jSnHU/vRq1HVPYf8NaoKcw5wDPavCT:F5e9/yOwg+/yOwgio5tUVpO
MD5:	EE90792188E08D70C180F92AB318B1CA
SHA1:	564EA5BF0155320A9635B895DF5AF6298DC2DFFF
SHA-256:	1A74745599EA2B3C75E34490D7682EF6E1EAEF6AD62361422CA7A2CF3A8C7E43
SHA-512:	97A255A89E56C2311EB61801563030243E3E9BFE5B9BF66373C950468B012F47B63FEDE35A8BD18D99BEF1D7A2844EE0614D0C6A82E39FCF51D7526E649BC572
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@p..V.@.....@.....@.....@.....@.....@......&.{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}'.Adobe Acrobat PDF Browser Plugin 4.8.25..5q4psw.msi.@.....@.....@.....@........&.{D557C495-7A3E-4038-8369-B6EDCD5EFABE}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}&.{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\....B.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll....D.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....%.Software\AdobeAcrobatPDFBrowserPlugin...@....(.&...AdobeAcrobatPDFBro

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	952832
Entropy (8bit):	6.765764209638377
Encrypted:	false
SSDEEP:	24576:UkgLxg2eMP8EN8Vo7zgDQ9uo4iZSBi/u3wXqx9jKVM5qx0YJ:x/jDQMo49wpq
MD5:	0C8E5B12B177A199008B2282C7506FFF
SHA1:	0DFEE8BAE7073512F8BFDABAF0C0B7C882B3864E
SHA-256:	9A407A2F0BA3C0E3BA3CFA2FFD6472DB3BC572B8EF08F1FBA7139CBD36CC8DCA
SHA-512:	6464EC42CCCB85E7C067AD9F7C8B804D064A6974E8184BC5134436FAD004BF87630869C107BB91F87BDC59F7938A8A157F59A436CE0265C070DB32A54C4541B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 4%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m..d...........#...8...................................................... ...........@... .........................hC......<............................ ...?..........................$J.......................................................text...4...........................`.0`.data...............................@.0..rdata..\|...........................@.0@.bss....D....p.......>................0..edata..hC.......D...>..............@.0@.idata..<...........................@.0..CRT....0...........................@.0..tls................................@.0..rsrc...b...........................@.0..reloc...?.......@...J..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.599233980549996
Encrypted:	false
SSDEEP:	3:LwBxFkvH4dGmMKLVKRLGPz4VAFkvH4dGmMKLVKRLGH:cHFkvYdlZKRLi7FkvYdlZKRL4
MD5:	0D4C9F15CE74465C59AE36A27F98C817
SHA1:	9CCE8EEFA4D3D9C5E161C5DBB860CFE1489C6B1A
SHA-256:	D24E3399060B51F3A1C9D41A67DE2601888A35C99DA8DB70070D757BB3F1913A
SHA-512:	9BED0EAFC2CF2A2360850CA1070FFB04AC14F04C78379485998A93F45012B5C11CC7F6F68129F65B8B5F90437CB965908C6A1BB9D83A56B068D6BDE1D5FDAD1F
Malicious:	false
Preview:	MsgBox "Adobe Acrobat PDF Browser Plugin installation error 0x00000328", 16, "Adobe Acrobat PDF Browser Plugin installation error"..

C:\Windows\Installer\55f8ba.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {D557C495-7A3E-4038-8369-B6EDCD5EFABE}, Create Time/Date: Tue May 30 14:26:08 2023, Last Saved Time/Date: Tue May 30 14:26:08 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	7.919619627017417
Encrypted:	false
SSDEEP:	12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
MD5:	E35727B10193FE55DF216A1F9D166997
SHA1:	9DDAFA77FC9FDEA0085E41AA0F3A1EE0D15D9C8A
SHA-256:	696156D9A4117CBA652B18B012DB376FDDFBD7DB8B26A638C760D61B98D3590D
SHA-512:	2BBA74B0B7F5EE8509310030BB45DEF13B87394E55EDF8D0E51595D6CC669F4B2C7497D95331C09C9F7B453F3C9ACDEB03E41CD5E5DC14F9ECB9DD9F79D7AD8D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\55f8bc.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {D557C495-7A3E-4038-8369-B6EDCD5EFABE}, Create Time/Date: Tue May 30 14:26:08 2023, Last Saved Time/Date: Tue May 30 14:26:08 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	7.919619627017417
Encrypted:	false
SSDEEP:	12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
MD5:	E35727B10193FE55DF216A1F9D166997
SHA1:	9DDAFA77FC9FDEA0085E41AA0F3A1EE0D15D9C8A
SHA-256:	696156D9A4117CBA652B18B012DB376FDDFBD7DB8B26A638C760D61B98D3590D
SHA-512:	2BBA74B0B7F5EE8509310030BB45DEF13B87394E55EDF8D0E51595D6CC669F4B2C7497D95331C09C9F7B453F3C9ACDEB03E41CD5E5DC14F9ECB9DD9F79D7AD8D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFB1B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2138
Entropy (8bit):	5.597289542209639
Encrypted:	false
SSDEEP:	48:UWozIAJwCP3RDufgjYjRBoD8SY1eU/Vn0VaEVltgI4tK:UrMiHYjrAueywaEPNT
MD5:	D3DEA972DEEE8C5C7555BD734F9CE893
SHA1:	7DFE0F36C98DED75BED0AED621F42017EF914405
SHA-256:	50FCA99410D3EB92701142C205A548AF9510A4828E5A199976F6C69D8C7C2246
SHA-512:	C7C515090202A477F4E9204DF48C38C39CD0F0F270C1C462875B956B9697DF42DFAD570D22F47DD6CBD6A86E2AC8BC0A9198618A980306DDD653B6C50D13967B
Malicious:	false
Preview:	...@IXOS.@.....@p..V.@.....@.....@.....@.....@.....@......&.{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}'.Adobe Acrobat PDF Browser Plugin 4.8.25..5q4psw.msi.@.....@.....@.....@........&.{D557C495-7A3E-4038-8369-B6EDCD5EFABE}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}F.01:\Software\AdobeAcrobatPDFBrowserPlugin\AdobeAcrobatPDFBrowserPlugin.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\..).1\xssanpen\\|AdobeAcrobatPDFBrowserPlugin\......Please insert the disk: ..media3.cab.@.....@......C:\Windows\Installer\55f8ba.msi.........@........main.dll..dll_main..main.dll.@.....@.....@.......@...

C:\Windows\Installer\SourceHash{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1632735510729422
Encrypted:	false
SSDEEP:	12:JSbX72FjSAGiLIlHVRpth/7777777777777777777777777vDHFSiOdbEpSl0i8Q:JoQI5pidyF
MD5:	89D586E6AD6BEA01405949AF0BCA8A3A
SHA1:	2A73885282EB60DB9282FDDEFFB230D6AE3AE58B
SHA-256:	2FD787A10D63E9C2FEFBAFA9D4C424AC6893324A86D7EBE6C70D76BB6FAE39FD
SHA-512:	F38C1415A526A95CDB97077F59E0663CDAFA161B9EDFAB307893FF3D9A6F42E728248DCB242B54D54F4403421413A84A41D72FC96E4968A77ACE9D341C915C9A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5058400020774245
Encrypted:	false
SSDEEP:	48:q8PhfuRc06WXJ8FT57XgKuLMS5khp/rD6uLMSI818lP0:1hf1fFTVhvO
MD5:	6541081204CC56B31158430D26D58503
SHA1:	F3C2C50652559EC9AD81ACF9EE9A7B0492F784C3
SHA-256:	CDDCDF00A887B6E25DE72F11DADCBF93A0E85D1470F13B6569E442F736C89AE6
SHA-512:	E383B49FF2A65CC8EE0183DC97EF9B0EBEEB42E48EEF563A73329288B6A294941372CAC8F1EB67950F9EA0FC021BF0BA0988D9E4ACF952B0A9D34136CC3D4AF5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	192827
Entropy (8bit):	5.392015123446331
Encrypted:	false
SSDEEP:	3072:iHHJCoX5CNWFHjkzRl1pqf5JjzH6wbxygaK8Nkv6kF8Kwu8K8uBD556GIlZZ6bF7:i0LVlAp
MD5:	15A5D3FA6B4EFC956BFA3F1D4A6EA388
SHA1:	C077B611A721916F881B285BC496EC9B832A84A7
SHA-256:	15C927A1CB8FE141AE5869A43BEE0F915ACE9782344CCA811352F6F6C85FD56B
SHA-512:	8F055DE0656521E54BCBADE507536FE2805BABCF9DA23038CAC1818416BB2AA0105761D51F9FC6E26F77F3D6823D1B21B9CB1BA4343AAA453C5299402A00AA98
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..07/23/2020 10:13:25.847 [3928]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:13:25.863 [3928]: ngen returning 0x00000000..07/23/2020 10:13:25.925 [1900]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:13:25.925 [1900]: ngen returning 0x00000000..07/23/2020 10:13:25.972 [4436]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /N

C:\Windows\Temp\~DF092DC5D1FEAA268C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2099972641536612
Encrypted:	false
SSDEEP:	48:rsHugPveFXJxT5vXgKuLMS5khp/rD6uLMSI818lP0:IHAJTZhvO
MD5:	FD26F1A8E0428DC71ADD67C7258E7FC4
SHA1:	09021EC33DE22A721F2DA959584828D79E989251
SHA-256:	3D7E84CDEF142BBCF468F9EAA5C877F8B53C4F0EFFF84DA7D45134830EA3CAC7
SHA-512:	D2F007B25B05D4F658004CD15CA6EE655CEB8497C6B183AA355AEFE5EEF5DF1CE65DA12C6631C419F8CBC84A6D27ED951FFCD3C47851CC142CC897DAF0521E05
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3AFD14CAA7749B80.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2099972641536612
Encrypted:	false
SSDEEP:	48:rsHugPveFXJxT5vXgKuLMS5khp/rD6uLMSI818lP0:IHAJTZhvO
MD5:	FD26F1A8E0428DC71ADD67C7258E7FC4
SHA1:	09021EC33DE22A721F2DA959584828D79E989251
SHA-256:	3D7E84CDEF142BBCF468F9EAA5C877F8B53C4F0EFFF84DA7D45134830EA3CAC7
SHA-512:	D2F007B25B05D4F658004CD15CA6EE655CEB8497C6B183AA355AEFE5EEF5DF1CE65DA12C6631C419F8CBC84A6D27ED951FFCD3C47851CC142CC897DAF0521E05
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F77F918320563FF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4A6271EF11B37377.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06981105571250576
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOSlgOda8971N5QVky6lS:2F0i8n0itFzDHFSiOdbFS
MD5:	5958014AA25C5536AC922FB0F2586B9F
SHA1:	AE9F32F875238BDDEA22C343217DF64FB74AFE59
SHA-256:	D4E0FBF5B4E51B6A1076DFBE9B346D390714A0F796BC73C9D2CB187793961966
SHA-512:	DF3C3E2E61AB5EAB0C4A5CCEC40A07F9E3491CE7C0D6C4A74D476ADD9179A6494963789898DCD7E5741BCD9437B01E4D333F08729EAFDB37220BEB3647C0B73A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5555397D86C72808.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2099972641536612
Encrypted:	false
SSDEEP:	48:rsHugPveFXJxT5vXgKuLMS5khp/rD6uLMSI818lP0:IHAJTZhvO
MD5:	FD26F1A8E0428DC71ADD67C7258E7FC4
SHA1:	09021EC33DE22A721F2DA959584828D79E989251
SHA-256:	3D7E84CDEF142BBCF468F9EAA5C877F8B53C4F0EFFF84DA7D45134830EA3CAC7
SHA-512:	D2F007B25B05D4F658004CD15CA6EE655CEB8497C6B183AA355AEFE5EEF5DF1CE65DA12C6631C419F8CBC84A6D27ED951FFCD3C47851CC142CC897DAF0521E05
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA48F4C3EB3ED2F6F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB2E09CA8BE461258.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB404815109B1126A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5058400020774245
Encrypted:	false
SSDEEP:	48:q8PhfuRc06WXJ8FT57XgKuLMS5khp/rD6uLMSI818lP0:1hf1fFTVhvO
MD5:	6541081204CC56B31158430D26D58503
SHA1:	F3C2C50652559EC9AD81ACF9EE9A7B0492F784C3
SHA-256:	CDDCDF00A887B6E25DE72F11DADCBF93A0E85D1470F13B6569E442F736C89AE6
SHA-512:	E383B49FF2A65CC8EE0183DC97EF9B0EBEEB42E48EEF563A73329288B6A294941372CAC8F1EB67950F9EA0FC021BF0BA0988D9E4ACF952B0A9D34136CC3D4AF5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC45B0184A39B8DFE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCBDFB5D5B5D930C1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12081938981088994
Encrypted:	false
SSDEEP:	24:IUM70R818lOdWmOLqrb9ipVIdWmOLqrb9ipV7VO3wGtpJlrkg0+vB9J:D7R818lEuLMSouLMS5khp/r0gB
MD5:	7CE53BC4D5E97E3826DA403AD75C1ABF
SHA1:	337C7F389ADD4D4F3BB48CD0CC0071148E39685F
SHA-256:	B938E86FAE42605D29F33FECAB09EA5C72FC239AF372E93EC4F3E2F862061970
SHA-512:	B88CEF3E105D38543BABEB2AAF29A4BDF22932CA17B6E5D4F7532604C24E64378958932A7126CF9186159B327044852051EDA27854A4F090EBFF73B2E761BB7F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD8BC86747873A537.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5058400020774245
Encrypted:	false
SSDEEP:	48:q8PhfuRc06WXJ8FT57XgKuLMS5khp/rD6uLMSI818lP0:1hf1fFTVhvO
MD5:	6541081204CC56B31158430D26D58503
SHA1:	F3C2C50652559EC9AD81ACF9EE9A7B0492F784C3
SHA-256:	CDDCDF00A887B6E25DE72F11DADCBF93A0E85D1470F13B6569E442F736C89AE6
SHA-512:	E383B49FF2A65CC8EE0183DC97EF9B0EBEEB42E48EEF563A73329288B6A294941372CAC8F1EB67950F9EA0FC021BF0BA0988D9E4ACF952B0A9D34136CC3D4AF5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFD09074CA4B5BB91.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {D557C495-7A3E-4038-8369-B6EDCD5EFABE}, Create Time/Date: Tue May 30 14:26:08 2023, Last Saved Time/Date: Tue May 30 14:26:08 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Entropy (8bit):	7.919619627017417
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	5q4psw.msi
File size:	507904
MD5:	e35727b10193fe55df216a1f9d166997
SHA1:	9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a
SHA256:	696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d
SHA512:	2bba74b0b7f5ee8509310030bb45def13b87394e55edf8d0e51595d6cc669f4b2c7497d95331c09c9f7b453f3c9acdeb03e41cd5e5dc14f9ecb9dd9f79d7ad8d
SSDEEP:	12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
TLSH:	DDB423597606A371C4C82A72A63F77CAB6B17CA547074833C33FB2DE0D3657829267A1
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: msiexec.exePID: 6716, Parent PID: 3452

General

Target ID:	0
Start time:	22:59:29
Start date:	30/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\5q4psw.msi"
Imagebase:	0x7ff7baeb0000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 5660, Parent PID: 580

General

Target ID:	1
Start time:	22:59:30
Start date:	30/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7baeb0000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3676, Parent PID: 5660

General

Target ID:	2
Start time:	22:59:31
Start date:	30/05/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0x7ff684e90000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 7012, Parent PID: 5660

General

Target ID:	3
Start time:	22:59:31
Start date:	30/05/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Imagebase:	0x7ff7f07d0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3920, Parent PID: 3676

General

Target ID:	4
Start time:	22:59:31
Start date:	30/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0x12e0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.381770135.000000000360A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.381884570.0000000005230000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 6000, Parent PID: 3920

General

Target ID:	5
Start time:	22:59:34
Start date:	30/05/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x300000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: rundll32.exePID: 3920, Parent PID: 3676COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.8%
Total number of Nodes:	16
Total number of Limit Nodes:	0

Executed Functions

Function 1002A4FB Relevance: 1.5, APIs: 1, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?), ref: 1002A524

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 485ff5df04f8ee2b44346524c68e78e88d06071511fcdec404aceb0375cb2ab2
Instruction ID: 00f80fa798212d279aa3a4e3fc9d35ec11821ce49b1a2f68508c6e23295b72c3
Opcode Fuzzy Hash: 485ff5df04f8ee2b44346524c68e78e88d06071511fcdec404aceb0375cb2ab2
Instruction Fuzzy Hash: 0DE09A70D08529EFCB20DB84E180A9DBBB1FB0A325FA54481ED51A6211CB35EE85AF10

Uniqueness

Uniqueness Score: -1.00%

Function 1002A61E Relevance: 1.3, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00002F44,?,00002F44,00000002), ref: 1002A6BA

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c8a91bb3f52504b34851642bff6f911aa0904a126f9de841362222e4fb7c4aba
Instruction ID: 8a4044d8f8fd50a6a134e65f0457b5eacbbcbdc5684dba151f3aee4cf353d954
Opcode Fuzzy Hash: c8a91bb3f52504b34851642bff6f911aa0904a126f9de841362222e4fb7c4aba
Instruction Fuzzy Hash: B81142B1D1C205EFDB30DA90FCD974DA6B8E71A204FF94026AE0065242EF2518C4BA25

Uniqueness

Uniqueness Score: -1.00%

Function 1002A4E1 Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00007E7E,00007E7E), ref: 1002A5FE

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0641292201ec43dba3f4cc9da24f777aeb42a299be4718644466048f13d02087
Instruction ID: 758a69f25ca6f6719b3215040b18abb149fc83eeb57a41baf1fe90a80d390342
Opcode Fuzzy Hash: 0641292201ec43dba3f4cc9da24f777aeb42a299be4718644466048f13d02087
Instruction Fuzzy Hash: F8012571D08929EFDF66CE80E988A9E7AB5FB06204FA000A1ED0162121DB359A90FB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1000DD40 Relevance: 88.2, APIs: 46, Strings: 4, Instructions: 685stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1000DD7C

Strings

mono, xrefs: 1000DD56
channels, xrefs: 1000E600
%d channels (%[^)], xrefs: 1000DE67
ambisonic , xrefs: 1000DDB0

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp
String ID: channels$%d channels (%[^)]$ambisonic $mono
API String ID: 1004003707-221731140
Opcode ID: 45f1ac248f250a8e972a1e3912f809fea1dca3a3124f7766f2dddc626e05e118
Instruction ID: 0fae87325a21616c7c2b42065aade432cabee47ba40fae089fd5de3c0fcae7df
Opcode Fuzzy Hash: 45f1ac248f250a8e972a1e3912f809fea1dca3a3124f7766f2dddc626e05e118
Instruction Fuzzy Hash: 67522774A083818FE350DF28C58061EBBE1FF89384F55892EE9999B359E774ED41CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002F110 Relevance: 39.2, APIs: 13, Strings: 9, Instructions: 668COMMON

Download Yara Rule

APIs

mv_small_strptime.MAIN ref: 1002F188

Strings

%Y - %m - %d, xrefs: 1002F251
%M:%S, xrefs: 1002F744
%H:%M, xrefs: 1002F68A
%H:%M:%S, xrefs: 1002F2CA
%Y%m%d, xrefs: 1002F26D
%H%M%S, xrefs: 1002F2E5
gfff, xrefs: 1002F5CF
now, xrefs: 1002F233
%J:%M:%S, xrefs: 1002F17C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_small_strptime
String ID: %H%M%S$%H:%M$%H:%M:%S$%J:%M:%S$%M:%S$%Y - %m - %d$%Y%m%d$gfff$now
API String ID: 1704653723-929505383
Opcode ID: 70551c3f807884e4d46f3108702462cb1203eb33ef54204aec50387936ae1137
Instruction ID: 646b59ec4b146e931ed9e50608571c6f79c7907caae039c014e067c05dcc172a
Opcode Fuzzy Hash: 70551c3f807884e4d46f3108702462cb1203eb33ef54204aec50387936ae1137
Instruction Fuzzy Hash: 8042F471A083458FD714CF28D48076AFBE2EFC5384F95897EE889C7352E631D9468B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000D4D0 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 306
COMMONCrypto

Download Yara Rule

C-Code - Quality: 27%

			E1000D4D0(void* __ebx, void* __edi, void* __esi) {
				char _t142;
				intOrPtr _t144;
				signed int _t145;
				signed int _t148;
				char _t160;
				signed int _t163;
				signed int _t166;
				unsigned int _t178;
				signed int _t182;
				char* _t191;
				char _t192;
				char* _t206;
				void* _t211;
				unsigned int _t227;
				intOrPtr _t238;
				intOrPtr _t241;
				signed int _t243;
				signed int _t250;
				signed int _t272;
				intOrPtr _t273;
				char* _t280;
				unsigned int _t284;
				intOrPtr _t285;
				signed int _t289;
				signed int _t292;
				void* _t293;
				char* _t329;
				unsigned int _t330;
				unsigned int _t332;
				signed int _t333;
				signed int _t337;
				unsigned int _t341;
				unsigned int _t351;
				char* _t353;
				intOrPtr _t379;
				char* _t380;
				signed int _t381;
				signed int _t382;
				char* _t386;
				unsigned int _t387;
				signed int _t388;
				char* _t390;
				signed int _t395;
				void* _t397;
				signed int _t399;
				signed int _t402;
				void* _t403;
				char _t420;
				signed int _t421;
				char* _t423;
				signed int _t425;
				char* _t426;
				char* _t428;
				void* _t431;
				char** _t432;
				char** _t434;
				char** _t435;
				intOrPtr* _t438;
				void* _t440;

				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_t432 = _t431 - 0x2c;
				_t423 = _t432[0x10];
				_t432[6] = _t432[0x11];
				_t142 =  *_t423;
				_t440 = _t142 - 2;
				if(_t440 == 0) {
					L60();
					if(_t432[6] >= 0) {
						goto L8;
					} else {
						goto L14;
					}
					goto L12;
				} else {
					if(_t440 > 0) {
						if(_t142 != 3) {
							_t144 = 0xffffffea;
							goto L12;
						} else {
							_t191 = _t432[6];
							_t434 =  &(_t432[0xb]);
							_t353 = _t423;
							_pop(_t273);
							_pop(_t403);
							_pop(_t389);
							_pop(_t427);
							_t428 = _t353;
							_t390 = _t191;
							_push(_t403);
							_push(_t273);
							_t435 = _t434 - 0x4c;
							_t192 =  *_t353;
							if(_t192 == 3) {
								_t206 = _t428[4];
								_t280 =  &(_t206[ !((((((_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) + ((((_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) >> 0x00000008) >> 0x00000010) + (((_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) + ((((_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[8] - (_t353[8] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) >> 0x00000008) & 0x0000003f) + (((((_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) + ((((_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) >> 0x00000008) >> 0x00000010) + (((_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) + ((((_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) & 0x33333333) + (_t353[0xc] - (_t353[0xc] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) >> 0x00000008) & 0x0000003f))]);
								goto L74;
							} else {
								_t332 = _t353[8];
								if(_t192 != 2) {
									_t435[5] = 0x29a;
									_t435[1] = 0;
									 *_t435 = 0;
									_t435[4] = "libavutil/channel_layout.c";
									_t435[3] = "channel_layout->order == AV_CHANNEL_ORDER_CUSTOM";
									_t435[2] = "Assertion %s failed at %s:%d\n";
									E10023A40();
									abort();
									_t438 = _t435 - 0x41c;
									 *((intOrPtr*)(_t438 + 0x418)) = _t273;
									_t238 =  *((intOrPtr*)(_t438 + 0x424));
									_t379 =  *((intOrPtr*)(_t438 + 0x428));
									if(_t238 != 0 || _t379 == 0) {
										 *((intOrPtr*)(_t438 + 8)) = _t379;
										_t285 = _t438 + 0x10;
										 *((intOrPtr*)(_t438 + 4)) = _t238;
										 *_t438 = _t285;
										E100089A0();
										 *((intOrPtr*)(_t438 + 4)) = _t285;
										 *_t438 =  *((intOrPtr*)(_t438 + 0x420));
										_t241 = E1000D4D0(_t285, _t390, _t403);
										if(_t241 >= 0) {
											_t241 =  *((intOrPtr*)(_t438 + 0x14));
										}
									} else {
										_t241 = 0xffffffea;
									}
									return _t241;
								} else {
									_t420 = _t353[4];
									_t380 = 0;
									_t280 = 0xffffffff;
									if(_t420 > 0) {
										do {
											_t206 =  *_t332 - 0x400;
											if(_t206 > 0x3ff) {
												goto L67;
											} else {
												if(_t380 > 0) {
													if( *((intOrPtr*)(_t332 - 0x18)) - 0x400 > 0x3ff || _t206 != _t380) {
														goto L72;
													} else {
														goto L66;
													}
												} else {
													if(_t206 > 0x3ff) {
														goto L67;
													} else {
														if(_t206 == _t380) {
															L66:
															_t280 = _t380;
															goto L67;
														} else {
															goto L72;
														}
													}
												}
											}
											goto L91;
											L67:
											_t380 =  &(_t380[1]);
											_t332 = _t332 + 0x18;
										} while (_t380 != _t420);
										L74:
										if(_t280 < 0) {
											goto L72;
										} else {
											asm("pxor xmm0, xmm0");
											asm("cvtsi2sd xmm0, ebx");
											asm("sqrtsd xmm0, xmm0");
											asm("cvttsd2si eax, xmm0");
											_t406 =  &(_t206[1]) *  &(_t206[1]);
											if(_t406 !=  &(_t280[1])) {
												goto L72;
											} else {
												_t435[2] = _t206;
												_t435[1] = "ambisonic %d";
												 *_t435 = _t390;
												E100089C0();
												_t329 = _t428[4];
												if(_t329 > _t406) {
													_t211 = 0;
													do {
														 *((intOrPtr*)(_t435 + _t211 + 0x28)) = 0;
														 *((intOrPtr*)(_t435 + _t211 + 0x2c)) = 0;
														_t211 = _t211 + 8;
													} while (_t211 < 0x18);
													if( *_t428 == 3) {
														_t330 = _t428[8];
														_t435[0xa] = 1;
														_t284 = _t428[0xc];
														_t435[0xc] = _t330;
														_t435[0xd] = _t284;
														_t227 = (((_t284 - (_t284 >> 0x00000001 & 0x55555555) & 0x33333333) + (_t284 - (_t284 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t284 - (_t284 >> 0x00000001 & 0x55555555) & 0x33333333) + (_t284 - (_t284 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) + ((((_t284 - (_t284 >> 0x00000001 & 0x55555555) & 0x33333333) + (_t284 - (_t284 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) >> 0x00000004) + (_t284 - (_t284 >> 0x00000001 & 0x55555555) & 0x33333333) + (_t284 - (_t284 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) & 0x0f0f0f0f) >> 8);
														_t406 = _t227 >> 0x10;
														_t435[0xb] = ((((_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) & 0x0f0f0f0f) + ((((_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) & 0x0f0f0f0f) >> 0x00000008) + ((((_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) & 0x0f0f0f0f) + ((((_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t330 - (_t330 >> 0x00000001 & 0x55555555) & 0x33333333) & 0x0f0f0f0f) >> 0x00000008) >> 0x00000010) & 0x0000003f) + (_t227 + (_t227 >> 0x00000010) & 0x0000003f);
													} else {
														_t284 = 2;
														_t435[0xa] = 2;
														_t435[0xb] = _t329 - _t406;
														_t435[0xc] = _t428[8] + (_t406 + _t406 * 2) * 8;
													}
													 *_t435 = _t390;
													_t435[2] = 1;
													_t435[1] = 0x2b;
													E10008D20();
													_t435[1] = _t390;
													 *_t435 =  &(_t435[0xa]);
													E1000D4D0(_t284, _t390, _t406);
												}
												return 0;
											}
										}
									} else {
										L72:
										return 0xffffffea;
									}
								}
							}
						}
					} else {
						if(_t142 == 0) {
							_t148 = _t423[4];
							goto L59;
						} else {
							_t421 = _t423[8];
							_t243 = 4;
							_t333 = 0;
							_t289 = _t423[0xc];
							_t381 = 0;
							while((_t333 ^ _t289 | _t243 ^ _t421) != 0) {
								_t381 =  &(1[_t381]);
								if(_t381 == 0x1f) {
									L14:
									_t145 = _t423[4];
									if(_t145 != 0) {
										_t432[2] = _t145;
										_t432[1] = "%d channels (";
										 *_t432 = _t432[6];
										E100089C0();
										_t395 = _t423[4];
										if(_t395 > 0) {
											_t425 = 0;
											_t386 = _t423;
											goto L19;
											do {
												do {
													L19:
													if(_t425 >= _t395) {
														L57:
														_t432[1] = 0x100aeacf;
														 *_t432 = _t432[6];
														E100089C0();
														goto L24;
													} else {
														_t160 =  *_t386;
														if(_t160 == 2) {
															_t292 =  *(_t386[8] + (_t425 + _t425 * 2) * 8);
															_t250 = _t292 - 0x400;
															if(_t425 != 0) {
																_t432[4] = _t292;
																_t432[1] = 0x100aeacf;
																 *_t432 = _t432[6];
																E100089C0();
																_t292 = _t432[4];
															}
															if(_t250 > 0x3ff) {
																goto L53;
															} else {
																goto L51;
															}
														} else {
															if(_t160 == 3) {
																_t178 = _t386[8];
																_t432[4] = _t178;
																_t432[5] = _t386[0xc];
																_t397 = _t395 - (((((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) >> 0x00000008) + ((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) >> 0x00000010) + (((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) >> 0x00000008) + ((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t178 - (_t178 >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t178 - (_t178 >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) & 0x0000003f) + ((((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) + (((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) >> 0x00000008) >> 0x00000010) + ((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) + (((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) + ((_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) >> 0x00000002 & 0x33333333) + (_t432[5] - (_t432[5] >> 0x00000001 & 0x55555555) & 0x33333333) >> 0x00000004) & 0x0f0f0f0f) >> 0x00000008) & 0x0000003f);
																_t272 = _t425 - _t397;
																if(_t425 >= _t397) {
																	goto L32;
																} else {
																	_t250 = 0;
																	if(_t425 == 0) {
																		L51:
																		_t432[2] = _t250;
																		_t432[1] = "AMBI%d";
																		 *_t432 = _t432[6];
																		E100089C0();
																	} else {
																		_t250 = _t425;
																		_t432[1] = 0x100aeacf;
																		_t64 = _t425 + 0x400; // 0x401
																		_t432[4] = _t64;
																		 *_t432 = _t432[6];
																		E100089C0();
																		_t292 = _t432[4];
																		if(_t425 <= 0x3ff) {
																			goto L51;
																		} else {
																			goto L47;
																		}
																	}
																}
															} else {
																if(_t160 == 1) {
																	_t272 = _t425;
																	_t432[4] = _t386[8];
																	_t432[5] = _t386[0xc];
																	L32:
																	_t432[7] = _t425;
																	_t182 = _t432[4];
																	_t292 = 0;
																	_t351 = _t432[5];
																	_t426 = _t386;
																	do {
																		_t387 = _t351;
																		_t399 = (_t387 << 0x00000020 | _t182) >> _t292;
																		_t388 = _t387 >> _t292;
																		if((_t292 & 0x00000020) != 0) {
																			_t399 = _t388;
																		}
																		if((_t399 & 0x00000001) == 0) {
																			goto L34;
																		} else {
																			_t49 = _t272 - 1; // 0x0
																			_t402 = _t49;
																			if(_t272 != 0) {
																				_t272 = _t402;
																				goto L34;
																			} else {
																				_t386 = _t426;
																				_t425 = _t432[7];
																				if(_t425 != 0) {
																					_t432[4] = _t292;
																					_t432[1] = 0x100aeacf;
																					 *_t432 = _t432[6];
																					E100089C0();
																					_t292 = _t432[4];
																					L53:
																					if(_t292 <= 0x28) {
																						goto L41;
																					} else {
																						if(_t292 != 0xffffffff) {
																							goto L47;
																						} else {
																							goto L24;
																						}
																					}
																				} else {
																					if(_t292 > 0x28) {
																						L47:
																						_t432[2] = _t292;
																						_t432[1] = "USR%d";
																						 *_t432 = _t432[6];
																						E100089C0();
																					} else {
																						L41:
																						_t163 =  *(0x100af280 + _t292 * 8);
																						if(_t163 == 0) {
																							goto L47;
																						} else {
																							_t432[2] = _t163;
																							_t432[1] = "%s";
																							 *_t432 = _t432[6];
																							E100089C0();
																						}
																					}
																				}
																			}
																		}
																		goto L25;
																		L34:
																		_t292 =  &(1[_t292]);
																	} while (_t292 != 0x40);
																	_t386 = _t426;
																	_t425 = _t432[7];
																	if(_t425 == 0) {
																		goto L24;
																	} else {
																		goto L57;
																	}
																	goto L29;
																} else {
																	if(_t425 != 0) {
																		goto L57;
																	}
																	L24:
																	_t432[1] = "NONE";
																	 *_t432 = _t432[6];
																	E100089C0();
																}
															}
														}
													}
													L25:
													if( *_t386 != 2) {
														goto L18;
													} else {
														_t341 = _t386[8];
														_t166 = _t425 + _t425 * 2;
														_t293 = _t341 + _t166 * 8;
														if( *((char*)(_t341 + 4 + _t166 * 8)) == 0) {
															goto L18;
														} else {
															goto L27;
														}
													}
													goto L29;
													L27:
													_t425 =  &(1[_t425]);
													_t432[2] = _t293 + 4;
													_t432[1] = "@%s";
													 *_t432 = _t432[6];
													E100089C0();
													_t395 = _t386[4];
												} while (_t395 > _t425);
												goto L29;
												L18:
												_t395 = _t386[4];
												_t425 =  &(1[_t425]);
											} while (_t395 > _t425);
										}
										L29:
										if(_t395 == 0) {
											goto L15;
										} else {
											_t432[1] = 0x100aead1;
											 *_t432 = _t432[6];
											E100089C0();
											_t144 = 0;
										}
									} else {
										L15:
										_t148 = 0;
										L59:
										_t432[2] = _t148;
										_t432[1] = "%d channels";
										 *_t432 = _t432[6];
										E100089C0();
										_t144 = 0;
									}
								} else {
									_t337 = _t381 << 5;
									_t6 = _t337 + 0x100aec90; // 0x0
									_t243 =  *_t6;
									_t7 = _t337 + 0x100aec94; // 0x0
									_t333 =  *_t7;
									continue;
								}
								goto L12;
							}
							_t382 = _t381 << 5;
							_t432[1] = "%s";
							_t9 = _t382 + 0x100aec80; // 0x100aeabb
							_t432[2] =  *_t9;
							 *_t432 = _t432[6];
							E100089C0();
							L8:
							_t144 = 0;
						}
						L12:
						return _t144;
					}
				}
				L91:
			}

0x1000d4d1
0x1000d4d2
0x1000d4d3
0x1000d4d4
0x1000d4db
0x1000d4df
0x1000d4e3
0x1000d4e6
0x1000d4e9
0x1000d586
0x1000d58d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d4ef
0x1000d4ef
0x1000d55b
0x1000d570
0x00000000
0x1000d55d
0x1000d55d
0x1000d561
0x1000d564
0x1000d566
0x1000d567
0x1000d568
0x1000d569
0x1000d911
0x1000d914
0x1000d916
0x1000d917
0x1000d918
0x1000d91b
0x1000d920
0x1000da10
0x1000da15
0x00000000
0x1000d922
0x1000d925
0x1000d928
0x1000db65
0x1000db6f
0x1000db73
0x1000db76
0x1000db7e
0x1000db86
0x1000db8e
0x1000db93
0x1000dba0
0x1000dba6
0x1000dbad
0x1000dbb4
0x1000dbbd
0x1000dbc3
0x1000dbc7
0x1000dbcb
0x1000dbcf
0x1000dbd2
0x1000dbde
0x1000dbe2
0x1000dbe5
0x1000dbec
0x1000dbee
0x1000dbee
0x1000dc00
0x1000dc00
0x1000dc00
0x1000dbff
0x1000d92e
0x1000d92e
0x1000d931
0x1000d933
0x1000d93a
0x1000d963
0x1000d965
0x1000d96f
0x00000000
0x1000d971
0x1000d973
0x1000d94f
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d975
0x1000d97a
0x00000000
0x1000d97c
0x1000d980
0x1000d955
0x1000d955
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d980
0x1000d97a
0x1000d973
0x00000000
0x1000d957
0x1000d957
0x1000d958
0x1000d95b
0x1000da17
0x1000da19
0x00000000
0x1000da1f
0x1000da1f
0x1000da23
0x1000da27
0x1000da2b
0x1000da33
0x1000da38
0x00000000
0x1000da3e
0x1000da3e
0x1000da47
0x1000da4b
0x1000da4e
0x1000da53
0x1000da58
0x1000da5c
0x1000da5e
0x1000da5e
0x1000da62
0x1000da66
0x1000da69
0x1000da72
0x1000dac8
0x1000dad0
0x1000dad4
0x1000dad7
0x1000dadf
0x1000db44
0x1000db4f
0x1000db5c
0x1000da74
0x1000da7a
0x1000da7f
0x1000da85
0x1000da8c
0x1000da8c
0x1000da90
0x1000da9d
0x1000daa1
0x1000daa5
0x1000daae
0x1000dab2
0x1000dab5
0x1000dab5
0x1000dac3
0x1000dac3
0x1000da38
0x1000d93c
0x1000d982
0x1000d98e
0x1000d98e
0x1000d93a
0x1000d928
0x1000d920
0x1000d4f1
0x1000d4f3
0x1000d8e0
0x00000000
0x1000d4f9
0x1000d4f9
0x1000d4fc
0x1000d501
0x1000d503
0x1000d506
0x1000d527
0x1000d510
0x1000d514
0x1000d58f
0x1000d58f
0x1000d594
0x1000d59d
0x1000d5aa
0x1000d5ae
0x1000d5b1
0x1000d5b6
0x1000d5bb
0x1000d5c5
0x1000d5c7
0x1000d5c9
0x1000d5dc
0x1000d5dc
0x1000d5dc
0x1000d5de
0x1000d8be
0x1000d8c3
0x1000d8cb
0x1000d8ce
0x00000000
0x1000d5e4
0x1000d5e4
0x1000d5e9
0x1000d82c
0x1000d82e
0x1000d834
0x1000d836
0x1000d83f
0x1000d847
0x1000d84a
0x1000d84f
0x1000d84f
0x1000d859
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d5ef
0x1000d5f2
0x1000d720
0x1000d726
0x1000d72e
0x1000d7b9
0x1000d7bb
0x1000d7bf
0x00000000
0x1000d7c5
0x1000d7c5
0x1000d7c9
0x1000d85b
0x1000d85b
0x1000d864
0x1000d86c
0x1000d86f
0x1000d7cf
0x1000d7d4
0x1000d7d6
0x1000d7de
0x1000d7e4
0x1000d7e8
0x1000d7eb
0x1000d7f6
0x1000d7fa
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d7fa
0x1000d7c9
0x1000d5f8
0x1000d5f9
0x1000d68b
0x1000d690
0x1000d694
0x1000d698
0x1000d698
0x1000d69c
0x1000d6a0
0x1000d6a2
0x1000d6a6
0x1000d6bc
0x1000d6bc
0x1000d6c0
0x1000d6c3
0x1000d6c8
0x1000d6ca
0x1000d6ca
0x1000d6d2
0x00000000
0x1000d6d4
0x1000d6d4
0x1000d6d4
0x1000d6d9
0x1000d6b0
0x00000000
0x1000d6db
0x1000d6db
0x1000d6dd
0x1000d6e3
0x1000d879
0x1000d882
0x1000d88a
0x1000d88d
0x1000d892
0x1000d896
0x1000d899
0x00000000
0x1000d89f
0x1000d8a2
0x00000000
0x1000d8a8
0x00000000
0x1000d8a8
0x1000d8a2
0x1000d6e9
0x1000d6ec
0x1000d800
0x1000d800
0x1000d80d
0x1000d811
0x1000d814
0x1000d6f2
0x1000d6f2
0x1000d6f2
0x1000d6fb
0x00000000
0x1000d701
0x1000d701
0x1000d70a
0x1000d712
0x1000d715
0x1000d715
0x1000d6fb
0x1000d6ec
0x1000d6e3
0x1000d6d9
0x00000000
0x1000d6b2
0x1000d6b2
0x1000d6b3
0x1000d8b0
0x1000d8b2
0x1000d8b8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d5ff
0x1000d601
0x00000000
0x00000000
0x1000d607
0x1000d610
0x1000d614
0x1000d617
0x1000d617
0x1000d5f9
0x1000d5f2
0x1000d5e9
0x1000d620
0x1000d623
0x00000000
0x1000d625
0x1000d625
0x1000d628
0x1000d631
0x1000d634
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d634
0x00000000
0x1000d636
0x1000d63d
0x1000d63e
0x1000d647
0x1000d64b
0x1000d64e
0x1000d653
0x1000d656
0x00000000
0x1000d5d0
0x1000d5d0
0x1000d5d3
0x1000d5d4
0x1000d5dc
0x1000d660
0x1000d662
0x00000000
0x1000d668
0x1000d671
0x1000d675
0x1000d678
0x1000d67d
0x1000d67d
0x1000d596
0x1000d596
0x1000d596
0x1000d8e3
0x1000d8e3
0x1000d8ec
0x1000d8f4
0x1000d8f7
0x1000d8fc
0x1000d8fc
0x1000d516
0x1000d518
0x1000d51b
0x1000d51b
0x1000d521
0x1000d521
0x00000000
0x1000d521
0x00000000
0x1000d514
0x1000d52f
0x1000d537
0x1000d53b
0x1000d541
0x1000d549
0x1000d54c
0x1000d551
0x1000d551
0x1000d551
0x1000d575
0x1000d57c
0x1000d57c
0x1000d4ef
0x00000000

APIs

mv_bprintf.MAIN ref: 1000D54C
mv_bprintf.MAIN ref: 1000D8F7

Strings

%d channels, xrefs: 1000D8E7
AMBI%d, xrefs: 1000D85F
@%s, xrefs: 1000D642
USR%d, xrefs: 1000D808
%d channels (, xrefs: 1000D5A5
NONE, xrefs: 1000D60B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %d channels$%d channels ($@%s$AMBI%d$NONE$USR%d
API String ID: 3083893021-1306170362
Opcode ID: efc4cf4070b613ff96981b1c53d9dde21975b7a6fb51727448d4ce29c3f6a9dc
Instruction ID: a65011a6159dd3c9d8d2b84384c130b43f4f86832dc80880a9240f1aa98400e9
Opcode Fuzzy Hash: efc4cf4070b613ff96981b1c53d9dde21975b7a6fb51727448d4ce29c3f6a9dc
Instruction Fuzzy Hash: E6B1A675A087468BD704EF68C48062EB7E1FF98394F15882EE989C7345EB31ED44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10032510 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 10032539
BCryptGenRandom.BCRYPT ref: 10032563
BCryptCloseAlgorithmProvider.BCRYPT ref: 1003257A
mvpriv_open.MAIN ref: 10032597
_read.MSVCRT ref: 100325B7
_close.MSVCRT ref: 100325C1
mvpriv_open.MAIN ref: 100325DC
_read.MSVCRT ref: 100325FC
_close.MSVCRT ref: 10032606
clock.MSVCRT ref: 100326E8

Strings

N, xrefs: 10032855
RNG, xrefs: 1003251A
Microsoft Primitive Provider, xrefs: 10032514

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Crypt$AlgorithmProvider_close_readmvpriv_open$CloseOpenRandomclock
String ID: Microsoft Primitive Provider$N$RNG
API String ID: 4139849330-2077157618
Opcode ID: 18afe3c33630559fbd0355b581881ae8f3aa94268538246d15ca1b824b2066d5
Instruction ID: 296a7b6315f8af7d09067326692401f592c87ee6f10d7706e56fdac5cef6b261
Opcode Fuzzy Hash: 18afe3c33630559fbd0355b581881ae8f3aa94268538246d15ca1b824b2066d5
Instruction Fuzzy Hash: 55918E75A093108FE304EF38C9C061ABBE2EFC9312F95893EE9889B355E675D944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1002C390 Relevance: 30.2, APIs: 6, Strings: 11, Instructions: 402COMMON

Download Yara Rule

APIs

mv_opt_find2.MAIN ref: 1002C491

Strings

Unable to parse option value "%s", xrefs: 1002C9BD
none, xrefs: 1002C54A
max, xrefs: 1002C505
default, xrefs: 1002C4D2
The "%s" option is deprecated: %s, xrefs: 1002C850
min, xrefs: 1002C51F
const_values array too small for %s, xrefs: 1002C984
%d%*1[:/]%d%c, xrefs: 1002C919
all, xrefs: 1002C56F
9, xrefs: 1002C740
-, xrefs: 1002C7A2

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_opt_find2
String ID: %d%*1[:/]%d%c$-$9$The "%s" option is deprecated: %s$Unable to parse option value "%s"$all$const_values array too small for %s$default$max$min$none
API String ID: 2189843566-2859375014
Opcode ID: 730b512ef01ecd7330cf6e3f59345523149cc4a393a05c55e320839346850f87
Instruction ID: 478a8a207ff5b5307f9cfef852e9a26e9f05da79b4c8f966c849b1b138e3b10c
Opcode Fuzzy Hash: 730b512ef01ecd7330cf6e3f59345523149cc4a393a05c55e320839346850f87
Instruction Fuzzy Hash: CF023475A087498FC390DF69D08065BFBE5FFC9350F918A2EE9D987250EB35D8448B82

Uniqueness

Uniqueness Score: -1.00%

Function 100132D0 Relevance: 28.6, APIs: 19, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E100132D0() {
				void* _t43;
				intOrPtr _t61;
				intOrPtr _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				signed int _t72;
				signed int _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr* _t78;
				intOrPtr* _t84;
				intOrPtr* _t87;
				intOrPtr* _t93;
				void* _t94;
				intOrPtr* _t95;

				_t95 = _t94 - 0x2c;
				_t87 =  *((intOrPtr*)(_t95 + 0x40));
				if(_t87 != 0) {
					if( *((intOrPtr*)(_t87 + 0xc)) == 0) {
						L4:
						_t84 =  *((intOrPtr*)(_t87 + 0x1c));
						if(_t84 == 0) {
							L21:
							 *_t95 =  *_t87;
							L23();
							 *_t95 =  *((intOrPtr*)(_t87 + 8));
							L23();
							 *_t95 =  *((intOrPtr*)(_t87 + 0x14));
							L23();
							 *((intOrPtr*)(_t95 + 0x40)) = _t87;
							return __imp___aligned_free();
						}
						if( *((intOrPtr*)(_t84 + 0xc)) == 0) {
							L8:
							_t93 =  *((intOrPtr*)(_t84 + 0x1c));
							if(_t93 == 0) {
								L20:
								 *_t95 =  *_t84;
								L23();
								 *_t95 =  *((intOrPtr*)(_t84 + 8));
								L23();
								 *_t95 =  *((intOrPtr*)(_t84 + 0x14));
								L23();
								 *_t95 = _t84;
								L23();
								goto L21;
							}
							if( *((intOrPtr*)(_t93 + 0xc)) == 0) {
								L12:
								_t78 =  *((intOrPtr*)(_t93 + 0x1c));
								if(_t78 == 0) {
									L19:
									 *_t95 =  *_t93;
									L23();
									 *_t95 =  *((intOrPtr*)(_t93 + 8));
									L23();
									 *_t95 =  *((intOrPtr*)(_t93 + 0x14));
									L23();
									 *_t95 = _t93;
									L23();
									goto L20;
								}
								if( *((intOrPtr*)(_t78 + 0xc)) == 0) {
									L16:
									_t55 =  *((intOrPtr*)(_t78 + 0x1c));
									if( *((intOrPtr*)(_t78 + 0x1c)) != 0) {
										 *((intOrPtr*)(_t95 + 0x1c)) = _t78;
										E10012850(_t55);
										_t78 =  *((intOrPtr*)(_t95 + 0x1c));
									}
									 *((intOrPtr*)(_t95 + 0x1c)) = _t78;
									 *_t95 =  *_t78;
									L23();
									 *_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t95 + 0x1c)) + 8));
									L23();
									 *_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t95 + 0x1c)) + 0x14));
									L23();
									 *_t95 =  *((intOrPtr*)(_t95 + 0x1c));
									L23();
									goto L19;
								}
								_t72 = 0;
								do {
									 *((intOrPtr*)(_t95 + 0x1c)) = _t78;
									_t61 =  *((intOrPtr*)( *((intOrPtr*)(_t78 + 8)) + _t72 * 4));
									_t72 = _t72 + 1;
									 *_t95 = _t61;
									L23();
									_t78 =  *((intOrPtr*)(_t95 + 0x1c));
								} while (_t72 <  *((intOrPtr*)(_t78 + 0xc)));
								goto L16;
							}
							_t73 = 0;
							do {
								_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t93 + 8)) + _t73 * 4));
								_t73 = _t73 + 1;
								 *_t95 = _t63;
								L23();
							} while (_t73 <  *((intOrPtr*)(_t93 + 0xc)));
							goto L12;
						}
						_t74 = 0;
						do {
							_t65 =  *((intOrPtr*)( *((intOrPtr*)(_t84 + 8)) + _t74 * 4));
							_t74 = _t74 + 1;
							 *_t95 = _t65;
							L23();
						} while (_t74 <  *((intOrPtr*)(_t84 + 0xc)));
						goto L8;
					}
					_t75 = 0;
					do {
						_t67 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 8)) + _t75 * 4));
						_t75 = _t75 + 1;
						 *_t95 = _t67;
						L23();
					} while (_t75 <  *((intOrPtr*)(_t87 + 0xc)));
					goto L4;
				}
				return _t43;
			}

0x100132d4
0x100132d7
0x100132dd
0x100132e8
0x10013304
0x10013304
0x10013309
0x10013439
0x1001343b
0x1001343e
0x10013446
0x10013449
0x10013451
0x10013454
0x10013459
0x100265b0
0x100265b0
0x10013314
0x10013334
0x10013334
0x10013339
0x10013411
0x10013413
0x10013416
0x1001341e
0x10013421
0x10013429
0x1001342c
0x10013431
0x10013434
0x00000000
0x10013434
0x10013344
0x10013364
0x10013364
0x10013369
0x100133e8
0x100133eb
0x100133ee
0x100133f6
0x100133f9
0x10013401
0x10013404
0x10013409
0x1001340c
0x00000000
0x1001340c
0x10013370
0x1001339c
0x1001339c
0x100133a1
0x100133a3
0x100133a7
0x100133ac
0x100133ac
0x100133b0
0x100133b6
0x100133b9
0x100133c5
0x100133c8
0x100133d4
0x100133d7
0x100133e0
0x100133e3
0x00000000
0x100133e3
0x10013372
0x10013380
0x10013380
0x10013387
0x1001338a
0x1001338b
0x1001338e
0x10013393
0x10013397
0x00000000
0x10013380
0x10013346
0x10013350
0x10013353
0x10013356
0x10013357
0x1001335a
0x1001335f
0x00000000
0x10013350
0x10013316
0x10013320
0x10013323
0x10013326
0x10013327
0x1001332a
0x1001332f
0x00000000
0x10013320
0x100132ea
0x100132f0
0x100132f3
0x100132f6
0x100132f7
0x100132fa
0x100132ff
0x00000000
0x100132f0
0x10013477

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd52e100bb25c0641e34a9b4921baf3855db5dcfffc71db4c92606c3f5dca5a
Instruction ID: 64132198df639edcb8f9d9942dd31ac045c1fee33f6b38aeafb66a389db015b7
Opcode Fuzzy Hash: cbd52e100bb25c0641e34a9b4921baf3855db5dcfffc71db4c92606c3f5dca5a
Instruction Fuzzy Hash: 2851AE79A04B518FCB10EF79D4C595AF7E0FF48214F41892DE9A98B309EB30F9858B91

Uniqueness

Uniqueness Score: -1.00%

Function 1004C500 Relevance: 26.2, APIs: 17, Instructions: 666COMMON

Download Yara Rule

APIs

mv_tree_insert.MAIN ref: 1004C57E
mv_tree_find.MAIN ref: 1004C757
mv_tree_find.MAIN ref: 1004C776

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find$mv_tree_insert
String ID:
API String ID: 3047205218-0
Opcode ID: 80c4f16b25e93cf13fac10a13682a04c4d944ea14c030e41bdf2d1b908fff40c
Instruction ID: a50688713867d27fbf14d738fefbaa6eb2d970f68efb82bc5577a16e2e7c4afa
Opcode Fuzzy Hash: 80c4f16b25e93cf13fac10a13682a04c4d944ea14c030e41bdf2d1b908fff40c
Instruction Fuzzy Hash: 7152CF75A087499FC344DF1AC08091AFBE2FFC8654F658A2DE889DB315E730E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1002DCE0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 252
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 15%

			E1002DCE0(intOrPtr __ebx, void* __ecx, intOrPtr __edi, intOrPtr __esi, intOrPtr __ebp, void* __fp0, char* _a4, intOrPtr* _a8) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v48;
				signed int _v52;
				char* _v56;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v92;
				signed int _v96;
				char* _v100;
				char** _v104;
				char* _t152;
				signed int _t153;
				intOrPtr* _t163;
				signed int _t171;
				void* _t181;
				char** _t184;
				void* _t187;

				_v16 = __ebx;
				_t163 = _a8;
				_v12 = __esi;
				_t152 = _a4;
				_v8 = __edi;
				_v4 = __ebp;
				if(_t163 == 0 || _t152 == 0) {
					_t153 = 0xffffffea;
					goto L5;
				} else {
					_t171 =  *(_t163 + 0xc);
					_t181 =  *((intOrPtr*)(_t163 + 8)) + _t152;
					_t187 = _t171 - 0x13;
					if(_t187 > 0) {
						_v96 = _t171;
						 *_t184 = _t152;
						_v100 = "Not supported option type: %d, option name: %s\n";
						_v92 =  *_t163;
						_v104 = 0x18;
						E10023A40();
						_t153 = 0xbaa8beb0;
						L5:
						return _t153;
					}
					switch( *((intOrPtr*)(_t171 * 4 +  &M100B48E8))) {
						case 0:
							_v104 =  &_v52;
							 *_t184 = 0;
							L10027FA0(_t163, _t181);
							_t153 = (( *(_t163 + 0x10) ^ _v52 |  *(_t163 + 0x14) ^ _v48) & 0xffffff00 | _t187 == 0x00000000) & 0x000000ff;
							goto L5;
						case 1:
							 *__esp = 0;
							__ebp = 0;
							__edx = __esi;
							_v104 = 0;
							__ecx =  &_v52;
							__ebx = L10027FA0(__ebx, __esi);
							asm("movsd xmm0, [ebx+0x10]");
							goto L12;
						case 2:
							 *__esp = 0;
							__edi = 0;
							__edx = __esi;
							_v104 = 0;
							__ecx =  &_v52;
							__ebx = L10027FA0(__ebx, __esi);
							asm("pxor xmm0, xmm0");
							asm("cvtsd2ss xmm0, [ebx+0x10]");
							asm("cvtss2sd xmm0, xmm0");
							L12:
							__eax = 0;
							__edx = 0;
							asm("ucomisd xmm0, [esp+0x38]");
							0 | __eflags =  !=  ? 0 : 0 | __eflags;
							goto L5;
						case 3:
							__eax =  *__esi;
							__edx = __ebx[0x10];
							__eflags = __edx - __eax;
							if(__edx == __eax) {
								goto L10;
							}
							__eflags = __eax;
							if(__eax == 0) {
								goto L53;
							}
							__eflags = __edx;
							if(__edx == 0) {
								goto L53;
							}
							__eax = strcmp(__eax, __edx);
							__eflags = __eax;
							__eax = __al & 0x000000ff;
							goto L5;
						case 4:
							__ecx = 0x7fffffff;
							_v100 = 0x7fffffff;
							asm("movsd xmm0, [ebx+0x10]");
							asm("movsd [esp], xmm0");
							__eax = L10032F80(__eax, __ebx, __edi, __esi);
							__ecx =  *__esi;
							__esi = __esi[4];
							_v52 = __eax;
							__ebp = __edx;
							__ebx = __eax;
							_v48 = __ebp;
							__eax = __ecx;
							__edi = __ebp;
							__edx = __eax * __ebp >> 0x20;
							_v76 = __eax;
							__eax = __ebx;
							_v72 = __edx;
							__edx = __eax * __esi >> 0x20;
							__eax = __eax * __esi;
							_v64 = __edx;
							__edx = _v72;
							_v68 = __eax;
							__eax = _v64;
							__ebp = _v68;
							__edx = _v72 ^ _v64;
							__eax = _v76;
							__ebp = _v68 ^ _v76;
							_v68 ^ _v76 = _v68 ^ _v76 | _v72 ^ _v64;
							__eflags = _v68 ^ _v76 | _v72 ^ _v64;
							if((_v68 ^ _v76 | _v72 ^ _v64) != 0) {
								goto L53;
							}
							__eflags = __esi;
							if(__esi == 0) {
								goto L39;
							}
							__eflags = __edi;
							if(__edi == 0) {
								goto L39;
							}
							goto L10;
						case 5:
							__edi = __esi[4];
							__eax = 0;
							__edx = 0;
							_v52 = 0;
							__ebx = __ebx[0x10];
							_v48 = 0;
							__eflags = __edi;
							if(__edi == 0) {
								__eflags = __ebx;
								if(__ebx == 0) {
									goto L10;
								}
								__eax = 0;
								__eflags =  *__ebx;
								__eax = 0 |  *__ebx == 0x00000000;
								goto L5;
							}
							__eflags = __ebx;
							if(__ebx == 0) {
								goto L53;
							}
							__eflags =  *__ebx;
							if( *__ebx == 0) {
								goto L53;
							}
							__eax = strlen(__ebx);
							__edx = __eax;
							__eax = 0;
							__eflags = __edx - __edi;
							if(__edx != __edi) {
								goto L5;
							}
							__edx =  &_v52;
							__eax = __ebx;
							__esi =  *__esi;
							__eax = E10028BF0(__ebx,  &_v52);
							__ebx = _v52;
							__eflags = __eax;
							if(__eax == 0) {
								_v104 = __ebx;
								__eax = _v48;
								 *__esp = __esi;
								_v100 = __eax;
								L1009DC48();
								__eflags = __eax;
								_t128 = __eax == 0;
								__eflags = _t128;
								__eax = __eax & 0xffffff00 | _t128;
								__eax = __al & 0x000000ff;
							}
							 *__esp = __ebx;
							_v76 = __eax;
							L100265B0();
							__eax = _v76;
							goto L5;
						case 6:
							__esi =  *__esi;
							__edi =  &_v52;
							__eax = 0;
							_v52 = 0;
							__eax = 0;
							_v92 = 0;
							__eax = L":=";
							_v96 = L":=";
							__eax = 0x100b4567;
							_v100 = 0x100b4567;
							__eax = __ebx[0x10];
							 *__esp = __edi;
							_v104 = __ebx[0x10];
							__eax = E100118C0();
							__eflags = __eax;
							if(__eax < 0) {
								 *__esp = __edi;
								_v76 = __eax;
								E10011CC0();
								__eax = _v76;
								goto L5;
							}
							__ebp = 0;
							__ebx = 0;
							while(1) {
								_v100 = __ebx;
								__eax = 2;
								__edx = 0x100b3f1d;
								_v96 = 2;
								__eax = _v52;
								_v104 = 0x100b3f1d;
								 *__esp = _v52;
								__eax = E100110D0();
								__ecx = 2;
								_v100 = __ebp;
								__ebp = 0x100b3f1d;
								_v104 = 0x100b3f1d;
								_v96 = 2;
								 *__esp = __esi;
								__ebx = __eax;
								__eax = E100110D0();
								__eflags = __ebx;
								__ebp = __eax;
								if(__eflags == 0) {
									break;
								}
								__eflags = __eax;
								if(__eflags == 0) {
									break;
								}
								_v104 = __eax;
								__eax =  *__ebx;
								 *__esp =  *__ebx;
								__eflags = strcmp(??, ??);
								if(__eflags == 0) {
									__eax = _a4;
									_v104 = _a4;
									__eax = __ebx[4];
									 *__esp = __ebx[4];
									__eflags = strcmp(??, ??);
									if(__eflags != 0) {
										break;
									}
									continue;
								}
								break;
							}
							E10011CC0(__edi);
							__eax = 0;
							__ebx = __ebx | __ebp;
							__eax = 0 | __eflags == 0x00000000;
							goto L5;
						case 7:
							L10:
							__eax = 1;
							goto L5;
						case 8:
							__ebx = __ebx[0x10];
							__eflags = __ebx;
							if(__ebx == 0) {
								L51:
								__eax = 0;
								_v52 = 0;
								__eax = 0;
								__eflags = 0;
								L52:
								__eflags =  *__esi - __eax;
								if( *__esi == __eax) {
									__eax = _v52;
									__eflags = __esi[4] - __eax;
									__eax = __al & 0x000000ff;
									goto L5;
								}
								goto L53;
							}
							 *__esp = __ebx;
							__eax = 0x100b3bdc;
							_v104 = 0x100b3bdc;
							__eax = strcmp(??, ??);
							__eflags = __eax;
							if(__eax != 0) {
								_v100 = __ebx;
								__eax =  &_v52;
								_v104 =  &_v52;
								__eax =  &_v56;
								 *__esp =  &_v56;
								__eax = E1002E6E0();
								__eflags = __eax;
								if(__eax < 0) {
									goto L5;
								}
								__eax = _v56;
								goto L52;
							}
							goto L51;
						case 9:
							__eax = 0;
							_v52 = 0;
							__eax = 0;
							_v48 = 0;
							__eax = __ebx[0x10];
							__eflags = __eax;
							if(__eax == 0) {
								L53:
								__eax = 0;
								goto L5;
							}
							_v104 = __eax;
							__eax =  &_v52;
							 *__esp =  &_v52;
							__eax = E1002E7A0();
							__eflags = __eax;
							if(__eax < 0) {
								goto L5;
							}
							__ecx =  *__esi;
							__edi = __esi[4];
							__esi = _v48;
							__ebx = _v52;
							__eax = __ecx;
							__edx = __eax * __esi >> 0x20;
							_v76 = __eax;
							__eax = __ebx;
							_v72 = __edx;
							__edx = __eax * __edi >> 0x20;
							__eax = __eax * __edi;
							_v64 = __edx;
							__edx = _v72;
							_v68 = __eax;
							__eax = _v64;
							__ebp = _v68;
							__edx = _v72 ^ _v64;
							__eax = _v76;
							__ebp = _v68 ^ _v76;
							_v68 ^ _v76 = _v68 ^ _v76 | _v72 ^ _v64;
							__eflags = _v68 ^ _v76 | _v72 ^ _v64;
							if((_v68 ^ _v76 | _v72 ^ _v64) != 0) {
								goto L53;
							}
							__eflags = __esi;
							if(__esi == 0) {
								L39:
								__eflags = __ebx;
								if(__ebx == 0) {
									goto L53;
								}
								__eflags = __ecx;
								if(__eflags == 0) {
									goto L53;
								}
								__ecx = __ecx >> 0x1f;
								__eax = 0;
								__ecx =  &(__ebx[__ecx]);
								__eax = 0 | __eflags == 0x00000000;
								goto L5;
							}
							__eflags = __edi;
							__eax = 1;
							if(__edi != 0) {
								goto L5;
							}
							goto L39;
						case 0xa:
							__eax = __ebx[0x10];
							__ebp = 0;
							_v52 = 0;
							__eflags = __eax;
							if(__eax == 0) {
								L20:
								__eax = _v52;
								__eflags =  *__esi - __eax;
								__eax = __al & 0x000000ff;
								goto L5;
							}
							_v104 = __eax;
							__ebx = 0;
							__edi = 0xffffffff;
							_v96 = 0;
							__eax =  &_v52;
							_v100 = 0xffffffff;
							 *__esp =  &_v52;
							__eax = E1002E900(__fp0);
							__eflags = __eax;
							if(__eax < 0) {
								goto L5;
							}
							goto L20;
						case 0xb:
							__edx = 0;
							__eax = 0;
							__eflags = 0;
							do {
								 *((intOrPtr*)(__esp +  &(__eax[0x38]))) = 0;
								 *((intOrPtr*)(__esp +  &(__eax[0x3c]))) = 0;
								__eax =  &(__eax[8]);
								__eflags = __eax - 0x18;
							} while (__eax < 0x18);
							__eax = __ebx[0x10];
							__eflags = __eax;
							if(__eax == 0) {
								__edi =  &_v52;
								L25:
								_v104 = __edi;
								 *__esp = __esi;
								__eax = L1000EDB0(__ecx);
								__eflags = __eax;
								__eax = __al & 0x000000ff;
								goto L5;
							}
							_v104 = __eax;
							__edi =  &_v52;
							 *__esp = __edi;
							__eax = E1000DD40(__fp0);
							__eflags = __eax;
							if(__eax < 0) {
								goto L5;
							}
							goto L25;
					}
				}
			}

0x1002dce3
0x1002dce7
0x1002dceb
0x1002dcef
0x1002dcf3
0x1002dcf7
0x1002dcfd
0x1002e248
0x00000000
0x1002dd0b
0x1002dd0e
0x1002dd11
0x1002dd13
0x1002dd16
0x1002e191
0x1002e19a
0x1002e19d
0x1002e1a1
0x1002e1aa
0x1002e1ae
0x1002e1b3
0x1002dd5c
0x1002dd6f
0x1002dd6f
0x1002dd1c
0x00000000
0x1002dd2e
0x1002dd36
0x1002dd3d
0x1002dd59
0x00000000
0x00000000
0x1002de00
0x1002de07
0x1002de09
0x1002de0b
0x1002de0f
0x1002de15
0x1002de1a
0x00000000
0x00000000
0x1002de40
0x1002de47
0x1002de49
0x1002de4b
0x1002de4f
0x1002de55
0x1002de5a
0x1002de5e
0x1002de63
0x1002de1f
0x1002de1f
0x1002de21
0x1002de26
0x1002de2f
0x00000000
0x00000000
0x1002de70
0x1002de72
0x1002de75
0x1002de77
0x00000000
0x00000000
0x1002de7d
0x1002de7f
0x00000000
0x00000000
0x1002de85
0x1002de87
0x00000000
0x00000000
0x1002de94
0x1002de99
0x1002de9e
0x00000000
0x00000000
0x1002dd70
0x1002dd75
0x1002dd79
0x1002dd7e
0x1002dd83
0x1002dd88
0x1002dd8a
0x1002dd8d
0x1002dd91
0x1002dd93
0x1002dd95
0x1002dd99
0x1002dd9b
0x1002dd9d
0x1002dd9f
0x1002dda3
0x1002dda5
0x1002dda9
0x1002dda9
0x1002ddab
0x1002ddaf
0x1002ddb3
0x1002ddb7
0x1002ddbb
0x1002ddbf
0x1002ddc1
0x1002ddc5
0x1002ddc9
0x1002ddc9
0x1002ddcb
0x00000000
0x00000000
0x1002ddd1
0x1002ddd3
0x00000000
0x00000000
0x1002ddd9
0x1002dddb
0x00000000
0x00000000
0x00000000
0x00000000
0x1002e0d8
0x1002e0db
0x1002e0dd
0x1002e0df
0x1002e0e3
0x1002e0e6
0x1002e0ea
0x1002e0ec
0x1002e1c0
0x1002e1c2
0x00000000
0x00000000
0x1002e1c8
0x1002e1ca
0x1002e1cd
0x00000000
0x1002e1cd
0x1002e0f2
0x1002e0f4
0x00000000
0x00000000
0x1002e0fa
0x1002e0fd
0x00000000
0x00000000
0x1002e106
0x1002e10d
0x1002e10f
0x1002e111
0x1002e113
0x00000000
0x00000000
0x1002e119
0x1002e11d
0x1002e11f
0x1002e121
0x1002e126
0x1002e12a
0x1002e12c
0x1002e12e
0x1002e132
0x1002e136
0x1002e139
0x1002e13d
0x1002e142
0x1002e144
0x1002e144
0x1002e144
0x1002e147
0x1002e147
0x1002e14a
0x1002e14d
0x1002e151
0x1002e156
0x00000000
0x00000000
0x1002df50
0x1002df52
0x1002df56
0x1002df58
0x1002df5c
0x1002df5e
0x1002df62
0x1002df67
0x1002df6b
0x1002df70
0x1002df74
0x1002df77
0x1002df7a
0x1002df7e
0x1002df83
0x1002df85
0x1002e230
0x1002e233
0x1002e237
0x1002e23c
0x00000000
0x1002e23c
0x1002df8b
0x1002df8d
0x1002dfae
0x1002dfae
0x1002dfb2
0x1002dfb7
0x1002dfbc
0x1002dfc0
0x1002dfc4
0x1002dfc8
0x1002dfcb
0x1002dfd0
0x1002dfd5
0x1002dfd9
0x1002dfde
0x1002dfe2
0x1002dfe6
0x1002dfe9
0x1002dfeb
0x1002dff0
0x1002dff2
0x1002dff4
0x00000000
0x00000000
0x1002dff6
0x1002dff8
0x00000000
0x00000000
0x1002dffc
0x1002e000
0x1002e002
0x1002e00a
0x1002e00c
0x1002df98
0x1002df9b
0x1002df9f
0x1002dfa2
0x1002dfaa
0x1002dfac
0x00000000
0x00000000
0x00000000
0x1002dfac
0x00000000
0x1002e00c
0x1002e011
0x1002e016
0x1002e018
0x1002e01a
0x00000000
0x00000000
0x1002ddf0
0x1002ddf0
0x00000000
0x00000000
0x1002e160
0x1002e163
0x1002e165
0x1002e17c
0x1002e17c
0x1002e17e
0x1002e182
0x1002e182
0x1002e184
0x1002e184
0x1002e186
0x1002e1d8
0x1002e1dc
0x1002e1e2
0x00000000
0x1002e1e2
0x00000000
0x1002e186
0x1002e167
0x1002e16a
0x1002e16f
0x1002e173
0x1002e178
0x1002e17a
0x1002e1f0
0x1002e1f4
0x1002e1f8
0x1002e1fc
0x1002e200
0x1002e203
0x1002e208
0x1002e20a
0x00000000
0x00000000
0x1002e210
0x00000000
0x1002e210
0x00000000
0x00000000
0x1002e028
0x1002e02a
0x1002e02e
0x1002e030
0x1002e034
0x1002e037
0x1002e039
0x1002e188
0x1002e188
0x00000000
0x1002e188
0x1002e03f
0x1002e043
0x1002e047
0x1002e04a
0x1002e04f
0x1002e051
0x00000000
0x00000000
0x1002e057
0x1002e059
0x1002e05c
0x1002e060
0x1002e064
0x1002e066
0x1002e068
0x1002e06c
0x1002e06e
0x1002e072
0x1002e072
0x1002e074
0x1002e078
0x1002e07c
0x1002e080
0x1002e084
0x1002e088
0x1002e08a
0x1002e08e
0x1002e092
0x1002e092
0x1002e094
0x00000000
0x00000000
0x1002e09a
0x1002e09c
0x1002e0b0
0x1002e0b0
0x1002e0b2
0x00000000
0x00000000
0x1002e0b8
0x1002e0ba
0x00000000
0x00000000
0x1002e0c0
0x1002e0c3
0x1002e0c8
0x1002e0ca
0x00000000
0x1002e0ca
0x1002e09e
0x1002e0a0
0x1002e0a5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002deb0
0x1002deb3
0x1002deb5
0x1002deb9
0x1002debb
0x1002dee4
0x1002dee4
0x1002dee8
0x1002deed
0x00000000
0x1002deed
0x1002debd
0x1002dec1
0x1002dec3
0x1002dec8
0x1002decc
0x1002ded0
0x1002ded4
0x1002ded7
0x1002dedc
0x1002dede
0x00000000
0x00000000
0x00000000
0x00000000
0x1002def8
0x1002defa
0x1002defa
0x1002defc
0x1002defc
0x1002df00
0x1002df04
0x1002df07
0x1002df07
0x1002df0c
0x1002df0f
0x1002df11
0x1002e220
0x1002df2f
0x1002df2f
0x1002df33
0x1002df36
0x1002df3b
0x1002df40
0x00000000
0x1002df40
0x1002df17
0x1002df1b
0x1002df1f
0x1002df22
0x1002df27
0x1002df29
0x00000000
0x00000000
0x00000000
0x00000000
0x1002dd1c

APIs

mv_d2q.MAIN ref: 1002DD83
strcmp.MSVCRT ref: 1002DE94
mv_dict_parse_string.MAIN ref: 1002DF7E
mv_dict_get.MAIN ref: 1002DFCB
mv_dict_get.MAIN ref: 1002DFEB
strcmp.MSVCRT ref: 1002E005
mv_dict_free.MAIN ref: 1002E011
strlen.MSVCRT ref: 1002E106
memcmp.MSVCRT ref: 1002E13D
mv_log.MAIN ref: 1002E1AE

Strings

Not supported option type: %d, option name: %s, xrefs: 1002E195

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_getstrcmp$memcmpmv_d2qmv_dict_freemv_dict_parse_stringmv_logstrlen
String ID: Not supported option type: %d, option name: %s
API String ID: 55484637-782529697
Opcode ID: c63797a275b4d609330de5b26b24716b168973df03217639e7d13897e72af698
Instruction ID: 3e795e4c3a2a968e6b5c9510d46be4c9a18b9f8608d568ce117406b6a0b45fd7
Opcode Fuzzy Hash: c63797a275b4d609330de5b26b24716b168973df03217639e7d13897e72af698
Instruction Fuzzy Hash: CAA10174A087419FD744DF29E58021ABBE1EF88380F918D2EB999DB355EB74EC409B42

Uniqueness

Uniqueness Score: -1.00%

Function 10020830 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 634
COMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E10020830(signed int __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t304;
				char* _t305;
				signed int _t314;
				signed int _t316;
				signed int _t325;
				signed int _t330;
				signed int _t331;
				signed int _t332;
				int _t335;
				signed int _t336;
				signed int _t338;
				signed int _t342;
				signed int _t344;
				signed int _t347;
				signed int _t348;
				signed char* _t350;
				signed int _t351;
				int _t352;
				signed int _t354;
				int _t355;
				signed int _t356;
				signed int _t358;
				int _t361;
				signed int _t362;
				void _t364;
				signed int _t365;
				signed int _t367;
				signed int _t369;
				signed int _t372;
				intOrPtr _t379;
				intOrPtr _t380;
				intOrPtr _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				intOrPtr _t384;
				signed int _t386;
				signed int _t388;
				char* _t389;
				signed int _t393;
				signed char _t398;
				void* _t399;
				char* _t405;
				char _t406;
				char* _t408;
				signed int _t409;
				signed char _t411;
				signed int _t413;
				signed int _t414;
				signed int _t417;
				signed int _t418;
				signed short _t425;
				void* _t429;
				char* _t430;
				unsigned int _t434;
				signed int _t435;
				signed int _t437;
				signed char _t439;
				signed char* _t440;
				unsigned int _t441;
				signed int _t442;
				int _t444;
				signed char _t449;
				void* _t450;
				signed int _t453;
				signed int _t454;
				intOrPtr _t455;
				signed char _t456;
				signed char _t457;
				int _t458;
				char* _t463;
				char* _t464;
				signed int _t465;
				signed int _t467;
				signed int _t471;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t479;
				signed int* _t484;
				signed int _t489;
				signed int _t494;
				void _t495;
				char* _t496;
				signed int _t498;
				void* _t499;
				signed int _t501;
				void* _t502;
				void* _t503;
				signed int _t507;
				intOrPtr _t508;
				intOrPtr _t509;
				void* _t514;
				signed int _t517;
				char* _t519;
				signed int _t526;
				signed int _t528;
				int _t533;
				signed int _t534;
				void* _t537;
				signed int* _t538;
				signed int _t539;
				char* _t540;
				void* _t541;
				unsigned int _t543;
				unsigned int _t544;
				signed int _t545;
				signed int _t547;
				signed int _t548;
				signed int _t549;
				signed int _t550;
				signed int _t552;
				int _t553;
				void* _t554;
				char** _t555;
				signed int* _t557;
				void* _t571;

				_t465 = __edx;
				_t555 = _t554 - 0x6c;
				_t408 = _t555[0x24];
				_t519 = _t555[0x22];
				_t555[3] = _t555[0x27];
				 *_t555 = _t408;
				_t555[2] = _t555[0x26];
				_t555[1] = _t555[0x25];
				_t304 = E10020660(__edx, __eflags);
				 *_t555 = _t408;
				_t543 = _t304;
				_t305 = E10031C70();
				_t555[0x12] = _t305;
				_t430 = _t305;
				if((_t543 >> 0x0000001f | _t465 & 0xffffff00 | _t543 - _t555[0x21] > 0x00000000) != 0 || _t430 == 0) {
					_t544 = 0xffffffea;
					goto L28;
				} else {
					_t467 = _t430[4] & 0x000000ff;
					if(_t467 == 0) {
						_t496 = 0;
						_t555[0xf] = 0;
					} else {
						_t463 =  >=  ? _t430[0x10] : 0;
						_t555[0xf] = _t463;
						_t496 = _t463;
						if(_t467 != 1) {
							_t464 = _t555[0x12];
							_t496 =  >=  ? _t555[0xf] : _t464[0x24];
							_t555[0xf] = _t496;
							if(_t467 != 2) {
								_t405 =  >=  ? _t496 : _t464[0x38];
								_t555[0xf] = _t405;
								_t496 = _t405;
								if(_t467 != 3) {
									_t406 = _t464[0x4c];
									_t571 = _t496 - _t406;
									_t407 =  >=  ? _t496 : _t406;
									_t555[0xf] =  >=  ? _t496 : _t406;
								}
							}
						}
					}
					_t555[1] = _t408;
					_t555[2] = _t555[0x25];
					 *_t555 =  &(_t555[0x14]);
					if(E1001EAB0(_t571) < 0) {
						_t555[5] = 0x209;
						__eflags = 0;
						_t555[1] = 0;
						 *_t555 = 0;
						_t555[4] = "libavutil/imgutils.c";
						_t555[3] = "ret >= 0";
						_t555[2] = "Assertion %s failed at %s:%d\n";
						E10023A40();
						abort();
						_push(_t543);
						_push(_t496);
						_t557 = _t555 - 0x15c;
						_t409 = _t557[0x5e];
						 *_t557 = _t409;
						_t314 = E10031C70(_t408);
						 *_t557 = _t409;
						_t545 = _t314;
						_t557[0xd] = E10031D50(_t519);
						_t316 = 0;
						__eflags = 0;
						do {
							 *((intOrPtr*)(_t557 + _t316 + 0xd0)) = 0;
							 *((intOrPtr*)(_t557 + _t316 + 0xd4)) = 0;
							_t316 = _t316 + 8;
							__eflags = _t316 - 0x80;
						} while (_t316 < 0x80);
						_t557[0x14] = 0;
						_t557[0x15] = 0;
						_t557[0x16] = 0;
						_t557[0x17] = 0;
						_t557[0x18] = 0;
						_t557[0x19] = 0;
						_t557[0x1a] = 0;
						_t557[0x1b] = 0;
						__eflags = _t557[0xd] - 1 - 3;
						if(_t557[0xd] - 1 > 3) {
							L61:
							return 0xffffffea;
						} else {
							__eflags = _t545;
							if(_t545 == 0) {
								goto L61;
							} else {
								_t325 =  *(_t545 + 8);
								_t471 = _t325 & 0x00000008;
								_t498 = _t471;
								__eflags = _t498;
								if(_t498 != 0) {
									goto L61;
								} else {
									_t557[0xa] = _t325 & 0x00000020;
									__eflags = _t325 & 0x00000004;
									if(__eflags != 0) {
										 *_t557 = _t409;
										_t557[2] = 0;
										_t557[1] = _t557[0x60];
										_t547 = E1001E960(__eflags);
										_t330 = _t409 - 9;
										__eflags = _t330 - 1;
										_t331 = _t330 & 0xffffff00 | _t330 - 0x00000001 < 0x00000000;
										__eflags = _t409 - 9;
										_t411 =  !=  ? _t498 : 0xff;
										__eflags = _t557[0xd] - 1;
										if(__eflags != 0 || __eflags == 0) {
											goto L61;
										} else {
											__eflags = _t547;
											if(_t547 <= 0) {
												goto L61;
											} else {
												__eflags = _t557[0x5c];
												if(_t557[0x5c] != 0) {
													__eflags = _t557[0x61];
													_t526 =  *(_t557[0x5c]);
													if(_t557[0x61] > 0) {
														_t335 = (_t411 & 0x000000ff) * 0x1010101;
														__eflags = _t335;
														do {
															__eflags = _t547 - 8;
															_t474 = _t547;
															_t499 = _t526;
															if(_t547 >= 8) {
																__eflags = _t526 & 0x00000001;
																if((_t526 & 0x00000001) != 0) {
																	 *_t526 = _t335;
																	_t499 = _t526 + 1;
																	_t226 = _t547 - 1; // -1
																	_t474 = _t226;
																}
																__eflags = _t499 & 0x00000002;
																if((_t499 & 0x00000002) != 0) {
																	 *_t499 = _t335;
																	_t474 = _t474 - 2;
																	_t499 = _t499 + 2;
																}
																__eflags = _t499 & 0x00000004;
																if((_t499 & 0x00000004) != 0) {
																	 *_t499 = _t335;
																	_t474 = _t474 - 4;
																	_t499 = _t499 + 4;
																}
																_t434 = _t474;
																_t474 = _t474 & 0x00000003;
																_t435 = _t434 >> 2;
																_t335 = memset(_t499, _t335, _t435 << 2);
																_t557 =  &(_t557[3]);
																_t499 = _t499 + _t435;
															}
															_t475 = _t474 & 0x00000007;
															__eflags = _t475;
															if(_t475 != 0) {
																_t437 = 0;
																__eflags = 0;
																do {
																	 *(_t499 + _t437) = _t411;
																	_t437 = _t437 + 1;
																	__eflags = _t437 - _t475;
																} while (_t437 < _t475);
															}
															_t526 = _t526 +  *(_t557[0x5d]);
															_t216 =  &(_t557[0x61]);
															 *_t216 = _t557[0x61] - 1;
															__eflags =  *_t216;
														} while ( *_t216 != 0);
													}
												}
												goto L78;
											}
										}
									} else {
										_t477 =  *(_t545 + 4) & 0x000000ff;
										__eflags = _t477;
										if(__eflags == 0) {
											L58:
											_t557[0xa] = _t545;
											_t501 = _t557[0x60];
											_t548 = 0;
											_t528 = _t557[0xd];
											while(1) {
												_t557[2] = _t548;
												_t557[1] = _t501;
												 *_t557 = _t409;
												_t336 = E1001E960(__eflags);
												 *(_t557 + 0x60 + _t548 * 4) = _t336;
												__eflags = _t336;
												if(_t336 < 0) {
													goto L61;
												}
												_t548 = _t548 + 1;
												__eflags = _t528 - _t548;
												if(__eflags <= 0) {
													_t549 = _t557[0xa];
													__eflags = _t557[0x5c];
													if(_t557[0x5c] == 0) {
														L78:
														_t332 = 0;
														__eflags = 0;
													} else {
														_t557[0x13] = _t549;
														__eflags = 0;
														_t557[0xe] =  &(_t557[0x34]);
														_t557[0xa] = 0;
														do {
															_t338 = _t557[0xa];
															_t557[0xf] =  *(_t557 + 0x60 + _t338 * 4);
															_t550 =  *(_t557[0x5c] + _t338 * 4);
															__eflags = _t338 - 1 - 1;
															if(_t338 - 1 <= 1) {
																_t439 =  *(_t557[0x13] + 6) & 0x000000ff;
																_t342 = 1 << _t439;
															} else {
																_t342 = 1;
																_t439 = 0;
																__eflags = 0;
															}
															_t344 = _t342 + _t557[0x61] - 1 >> _t439;
															_t557[0xc] = _t344;
															__eflags = _t344;
															if(_t344 > 0) {
																_t413 =  *(_t557 + 0x50 + _t557[0xa] * 4);
																_t347 = _t557[0xf];
																_t557[0xb] = _t413;
																__eflags = _t347 - _t413;
																_t533 =  >  ? _t413 : _t347;
																_t557[0x10] = _t533;
																_t348 = _t347 - _t533;
																__eflags = _t348;
																_t557[0x11] = _t348;
																do {
																	_t534 = _t557[0xb];
																	__eflags = _t534;
																	if(_t534 != 0) {
																		_t350 = _t557[0xe];
																		_t479 =  *_t350 & 0x000000ff;
																		_t440 =  &(_t350[_t534]);
																		while(1) {
																			__eflags =  *_t350 - _t479;
																			if( *_t350 != _t479) {
																				break;
																			}
																			_t350 =  &(_t350[1]);
																			__eflags = _t440 - _t350;
																			if(_t440 == _t350) {
																				L103:
																				_t351 = _t557[0xf];
																				_t502 = _t550;
																				__eflags = _t351 - 8;
																				_t414 = _t351;
																				if(_t351 >= 8) {
																					_t352 = _t479 * 0x1010101;
																					__eflags = _t550 & 0x00000001;
																					if((_t550 & 0x00000001) != 0) {
																						 *_t550 = _t352;
																						_t502 = _t550 + 1;
																						_t414 = _t557[0xf] - 1;
																					}
																					__eflags = _t502 & 0x00000002;
																					if((_t502 & 0x00000002) != 0) {
																						 *_t502 = _t352;
																						_t414 = _t414 - 2;
																						_t502 = _t502 + 2;
																					}
																					__eflags = _t502 & 0x00000004;
																					if((_t502 & 0x00000004) != 0) {
																						 *_t502 = _t352;
																						_t414 = _t414 - 4;
																						_t502 = _t502 + 4;
																					}
																					_t441 = _t414;
																					_t414 = _t414 & 0x00000003;
																					_t442 = _t441 >> 2;
																					memset(_t502, _t352, _t442 << 2);
																					_t557 =  &(_t557[3]);
																					_t502 = _t502 + _t442;
																				}
																				_t413 = _t414 & 0x00000007;
																				__eflags = _t413;
																				if(_t413 != 0) {
																					_t354 = 0;
																					__eflags = 0;
																					do {
																						 *(_t502 + _t354) = _t479;
																						_t354 = _t354 + 1;
																						__eflags = _t354 - _t413;
																					} while (_t354 < _t413);
																				}
																			} else {
																				continue;
																			}
																			goto L100;
																		}
																		__eflags = _t557[0xb] - 1;
																		if(_t557[0xb] == 1) {
																			goto L103;
																		} else {
																			_t355 = _t557[0x10];
																			_t503 = _t550;
																			_t537 = _t557[0xe];
																			__eflags = _t355 - 8;
																			_t444 = _t355;
																			if(_t355 >= 8) {
																				__eflags = _t550 & 0x00000001;
																				if((_t550 & 0x00000001) != 0) {
																					_t356 =  *_t537 & 0x000000ff;
																					_t503 = _t550 + 1;
																					_t537 = _t537 + 1;
																					_t557[0x12] = _t356;
																					 *_t550 = _t356;
																					_t444 = _t557[0x10] - 1;
																				}
																				__eflags = _t503 & 0x00000002;
																				if((_t503 & 0x00000002) != 0) {
																					_t358 =  *_t537 & 0x0000ffff;
																					_t503 = _t503 + 2;
																					_t537 = _t537 + 2;
																					_t444 = _t444 - 2;
																					 *(_t503 - 2) = _t358;
																				}
																				__eflags = _t503 & 0x00000004;
																				if((_t503 & 0x00000004) != 0) {
																					_t364 =  *_t537;
																					_t503 = _t503 + 4;
																					_t537 = _t537 + 4;
																					_t444 = _t444 - 4;
																					 *(_t503 - 4) = _t364;
																				}
																			}
																			memcpy(_t503, _t537, _t444);
																			_t557 =  &(_t557[3]);
																			_t557[2] = _t557[0x11];
																			_t361 = _t557[0x10];
																			_t557[1] = _t361;
																			_t362 = _t361 + _t550;
																			__eflags = _t362;
																			 *_t557 = _t362;
																			E10026D10(_t413, _t537 + _t444 + _t444, _t537);
																		}
																	}
																	L100:
																	_t550 = _t550 +  *((intOrPtr*)(_t557[0x5d] + _t557[0xa] * 4));
																	_t267 =  &(_t557[0xc]);
																	 *_t267 = _t557[0xc] - 1;
																	__eflags =  *_t267;
																} while ( *_t267 != 0);
															}
															_t557[0xa] = _t557[0xa] + 1;
															_t557[0xe] = _t557[0xe] + 0x20;
															__eflags = _t557[0xd] - _t557[0xa];
														} while (_t557[0xd] > _t557[0xa]);
														_t332 = 0;
													}
													return _t332;
												} else {
													continue;
												}
												goto L122;
											}
											goto L61;
										} else {
											_t365 =  *(_t545 + 0x14);
											__eflags = _t365;
											_t447 =  >=  ? _t365 : 0;
											__eflags = _t365 - 0x20;
											 *((intOrPtr*)(_t557 + 0x50 +  *(_t545 + 0x10) * 4)) =  >=  ? _t365 : 0;
											if(_t365 > 0x20) {
												goto L61;
											} else {
												__eflags = _t477 - 1;
												if(__eflags == 0) {
													L46:
													_t557[0x5e] = _t409;
													_t557[0xa] = _t545;
													_t367 = _t557[0xa];
													_t557[0xc] = __eflags == 0;
													_t145 = _t545 + 0x10; // 0x10
													_t538 = _t145;
													__eflags = _t557[0x5f] - 2;
													_t557[0xe] = _t367;
													_t507 = 0;
													_t369 = (_t367 & 0xffffff00 | _t557[0x5f] != 0x00000002) & _t557[0xc] & 0x000000ff;
													__eflags = _t369;
													_t557[0xb] = _t369;
													while(1) {
														_t449 = _t538[4];
														asm("cdq");
														_t372 =  *(_t557 + 0x50 +  *_t538 * 4) / _t538[1];
														_t557[0x20] = 0;
														_t557[0x21] = 0;
														__eflags = _t449 - 0x10;
														_t557[0x22] = 0;
														_t557[0x23] = 0;
														if(_t449 > 0x10) {
															goto L61;
														}
														__eflags = _t449 - 7;
														if(_t449 > 7) {
															L50:
															__eflags = _t372;
															if(_t372 <= 0) {
																goto L61;
															} else {
																__eflags = _t507;
																if(_t507 != 0) {
																	L62:
																	_t199 = _t507 - 1; // -1
																	_t417 = 0;
																	__eflags = _t199 - 1;
																	if(_t199 <= 1) {
																		__eflags = _t557[0xe];
																		if(_t557[0xe] == 0) {
																			_t417 = 0x00000080 << _t449 - 0x00000008 & 0x0000ffff;
																		}
																	} else {
																		__eflags = _t507 - 3;
																		if(_t507 == 3) {
																			_t417 = (0x00000001 << _t449) - 0x00000001 & 0x0000ffff;
																		}
																	}
																} else {
																	__eflags = _t557[0xb];
																	if(_t557[0xb] == 0) {
																		goto L62;
																	} else {
																		_t425 = 0x10 << _t449 - 8;
																		__eflags = _t425;
																		_t417 = _t425 & 0x0000ffff;
																	}
																}
																_t552 =  &(_t557[0x24]);
																_t450 = _t552 + _t372 * 2;
																_t484 = _t552;
																do {
																	 *_t484 = _t417;
																	_t484 =  &(_t484[0]);
																	__eflags = _t450 - _t484;
																} while (_t450 != _t484);
																_t418 = _t557[0xa];
																_t538 =  &(_t538[5]);
																_t557[7] = _t372;
																_t557[5] = 0;
																_t557[0x1c] =  &(_t557[0x34]);
																_t557[4] = 0;
																_t557[0x1d] =  &(_t557[0x3c]);
																_t557[2] =  &(_t557[0x20]);
																_t557[0x1e] =  &(_t557[0x44]);
																_t557[6] = _t507;
																_t507 = _t507 + 1;
																_t557[1] =  &(_t557[0x1c]);
																_t557[3] = _t418;
																 *_t557 = _t552;
																_t557[0x1f] =  &(_t557[0x4c]);
																E100316F0();
																__eflags = ( *(_t418 + 4) & 0x000000ff) - _t507;
																if(__eflags > 0) {
																	continue;
																} else {
																	_t545 = _t557[0xa];
																	_t409 = _t557[0x5e];
																	goto L58;
																}
															}
														} else {
															__eflags = _t557[0xc];
															if(_t557[0xc] != 0) {
																goto L61;
															} else {
																goto L50;
															}
														}
														goto L122;
													}
													goto L61;
												} else {
													_t453 =  *(_t545 + 0x24);
													_t508 =  *((intOrPtr*)(_t545 + 0x28));
													_t379 =  *((intOrPtr*)(_t557 + 0x50 + _t453 * 4));
													__eflags = _t379 - _t508;
													_t380 =  <  ? _t508 : _t379;
													 *((intOrPtr*)(_t557 + 0x50 + _t453 * 4)) = _t380;
													__eflags = _t380 - 0x20;
													if(_t380 > 0x20) {
														goto L61;
													} else {
														__eflags = _t477 - 2;
														if(__eflags == 0) {
															goto L46;
														} else {
															_t454 =  *(_t545 + 0x38);
															_t509 =  *((intOrPtr*)(_t545 + 0x3c));
															_t381 =  *((intOrPtr*)(_t557 + 0x50 + _t454 * 4));
															__eflags = _t381 - _t509;
															_t382 =  <  ? _t509 : _t381;
															 *((intOrPtr*)(_t557 + 0x50 + _t454 * 4)) = _t382;
															__eflags = _t382 - 0x20;
															if(_t382 > 0x20) {
																goto L61;
															} else {
																__eflags = _t477 - 3;
																if(__eflags == 0) {
																	goto L46;
																} else {
																	_t489 =  *(_t545 + 0x4c);
																	_t455 =  *((intOrPtr*)(_t545 + 0x50));
																	_t383 =  *((intOrPtr*)(_t557 + 0x50 + _t489 * 4));
																	__eflags = _t383 - _t455;
																	_t384 =  <  ? _t455 : _t383;
																	 *((intOrPtr*)(_t557 + 0x50 + _t489 * 4)) = _t384;
																	__eflags = _t384 - 0x20;
																	if(__eflags > 0) {
																		goto L61;
																	} else {
																		goto L46;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					} else {
						_t456 = 0;
						_t555[0x22] = _t519;
						_t539 = 0xffffffff;
						_t555[0x13] = _t543;
						_t555[0xe] = _t555[0x23];
						_t386 = 1;
						_t555[0x11] =  ~(_t555[0x27]);
						while(1) {
							_t388 = _t386 + _t555[0x26] - 1 >> _t456;
							_t429 = _t555[0x22][4 + _t539 * 4];
							_t555[0xc] = _t388;
							if(_t388 <= 0) {
								goto L18;
							}
							_t553 =  *(_t555 + 0x54 + _t539 * 4);
							_t555[0x10] = _t539;
							_t555[0xb] = 0;
							_t398 = _t555[0x20];
							_t555[0xd] = _t555[0x11] & _t553 + _t555[0x27] - 0x00000001;
							do {
								_t458 = _t553;
								_t514 = _t398;
								_t541 = _t429;
								if(_t553 >= 8) {
									if((_t398 & 0x00000001) != 0) {
										_t514 = _t398 + 1;
										_t541 = _t429 + 1;
										 *_t398 =  *_t429 & 0x000000ff;
										_t458 = _t553 - 1;
									}
									if((_t514 & 0x00000002) != 0) {
										_t494 =  *_t541 & 0x0000ffff;
										_t514 = _t514 + 2;
										_t541 = _t541 + 2;
										_t458 = _t458 - 2;
										 *(_t514 - 2) = _t494;
									}
									if((_t514 & 0x00000004) != 0) {
										_t495 =  *_t541;
										_t514 = _t514 + 4;
										_t541 = _t541 + 4;
										_t458 = _t458 - 4;
										 *(_t514 - 4) = _t495;
									}
								}
								_t399 = memcpy(_t514, _t541, _t458);
								_t555 =  &(_t555[3]);
								_t555[0xb] =  &(_t555[0xb][1]);
								_t517 = _t555[0xd];
								_t398 = _t399 + _t517;
								_t429 = _t429 +  *(_t555[0xe]);
							} while (_t555[0xc] != _t555[0xb]);
							_t539 = _t555[0x10];
							_t68 =  &(_t555[0x20]);
							 *_t68 = _t555[0x20] + _t555[0xc] * _t517;
							__eflags =  *_t68;
							L18:
							_t539 = _t539 + 1;
							__eflags = _t555[0xf] - _t539;
							if(_t555[0xf] != _t539) {
								__eflags = _t539 - 1;
								if(_t539 <= 1) {
									_t456 = _t555[0x12][6] & 0x000000ff;
									_t386 = 1 << _t456;
								} else {
									_t386 = 1;
									_t456 = 0;
									__eflags = 0;
								}
								_t555[0xe] =  &(_t555[0xe][4]);
								continue;
							}
							_t389 = _t555[0x12];
							_t544 = _t555[0x13];
							_t540 = _t555[0x22];
							__eflags = _t389[8] & 0x00000002;
							if((_t389[8] & 0x00000002) != 0) {
								_t457 = _t555[0x20];
								_t393 = 0;
								__eflags = 0;
								do {
									 *((intOrPtr*)(_t457 + _t393)) =  *((intOrPtr*)(_t540[4] + _t393));
									_t393 = _t393 + 4;
									__eflags = _t393 - 0x400;
								} while (_t393 != 0x400);
							}
							L28:
							return _t544;
							goto L122;
						}
					}
				}
				L122:
			}

0x10020830
0x10020834
0x1002083e
0x10020845
0x1002084c
0x10020857
0x1002085a
0x10020865
0x10020869
0x1002086e
0x10020871
0x10020873
0x10020882
0x10020886
0x1002088f
0x10020ab8
0x00000000
0x1002089d
0x1002089d
0x100208a3
0x10020aad
0x10020aaf
0x100208a9
0x100208b0
0x100208b6
0x100208ba
0x100208bc
0x100208be
0x100208c9
0x100208d1
0x100208d5
0x100208dc
0x100208e2
0x100208e6
0x100208e8
0x100208ea
0x100208ed
0x100208ef
0x100208f2
0x100208f2
0x100208e8
0x100208d5
0x100208bc
0x100208f6
0x10020901
0x10020909
0x10020913
0x10020abf
0x10020ac7
0x10020ac9
0x10020acd
0x10020ad0
0x10020ad8
0x10020ae0
0x10020ae8
0x10020aed
0x10020b00
0x10020b01
0x10020b04
0x10020b0a
0x10020b11
0x10020b14
0x10020b19
0x10020b1c
0x10020b25
0x10020b29
0x10020b29
0x10020b2b
0x10020b2b
0x10020b32
0x10020b39
0x10020b3c
0x10020b3c
0x10020b47
0x10020b4f
0x10020b57
0x10020b5d
0x10020b63
0x10020b6b
0x10020b6f
0x10020b73
0x10020b78
0x10020b7b
0x10020db1
0x10020dc0
0x10020b81
0x10020b81
0x10020b83
0x00000000
0x10020b89
0x10020b89
0x10020b90
0x10020b93
0x10020b93
0x10020b95
0x00000000
0x10020b9b
0x10020ba3
0x10020ba9
0x10020bac
0x10020e10
0x10020e1c
0x10020e20
0x10020e29
0x10020e2b
0x10020e2e
0x10020e31
0x10020e34
0x10020e3c
0x10020e3f
0x10020e44
0x00000000
0x10020e59
0x10020e59
0x10020e5b
0x00000000
0x10020e61
0x10020e68
0x10020e6a
0x10020e7a
0x10020e7c
0x10020e7e
0x10020e83
0x10020e83
0x10020e90
0x10020e90
0x10020e93
0x10020e95
0x10020e97
0x10020ed0
0x10020ed6
0x10020ef4
0x10020ef6
0x10020ef9
0x10020ef9
0x10020ef9
0x10020ed8
0x10020ede
0x10020f08
0x10020f0b
0x10020f0e
0x10020f0e
0x10020ee0
0x10020ee6
0x10020efe
0x10020f00
0x10020f03
0x10020f03
0x10020ee8
0x10020eea
0x10020eed
0x10020ef0
0x10020ef0
0x10020ef0
0x10020ef0
0x10020e99
0x10020e99
0x10020e9c
0x10020e9e
0x10020e9e
0x10020ea0
0x10020ea0
0x10020ea3
0x10020ea4
0x10020ea4
0x10020ea0
0x10020eb1
0x10020eb3
0x10020eb3
0x10020eb3
0x10020eb3
0x10020e90
0x10020e7e
0x00000000
0x10020e6a
0x10020e5b
0x10020bb2
0x10020bb2
0x10020bb6
0x10020bb8
0x10020d78
0x10020d78
0x10020d7e
0x10020d85
0x10020d87
0x10020d99
0x10020d99
0x10020d9d
0x10020da1
0x10020da4
0x10020da9
0x10020dad
0x10020daf
0x00000000
0x00000000
0x10020d90
0x10020d91
0x10020d93
0x10020f1a
0x10020f1e
0x10020f20
0x10020ebc
0x10020ebc
0x10020ebc
0x10020f22
0x10020f22
0x10020f2d
0x10020f2f
0x10020f33
0x10020f37
0x10020f37
0x10020f3f
0x10020f4a
0x10020f4e
0x10020f51
0x100210ab
0x100210b4
0x10020f57
0x10020f57
0x10020f5c
0x10020f5c
0x10020f5c
0x10020f69
0x10020f6b
0x10020f6f
0x10020f71
0x10020f7b
0x10020f7f
0x10020f83
0x10020f87
0x10020f8b
0x10020f8e
0x10020f92
0x10020f92
0x10020f94
0x10020fa0
0x10020fa0
0x10020fa4
0x10020fa6
0x10020fa8
0x10020fac
0x10020faf
0x10020fbd
0x10020fbd
0x10020fbf
0x00000000
0x00000000
0x10020fb8
0x10020fb9
0x10020fbb
0x10021030
0x10021030
0x10021034
0x10021036
0x10021039
0x1002103b
0x1002104e
0x10021054
0x1002105a
0x100210d0
0x100210d3
0x100210da
0x100210da
0x1002105c
0x10021062
0x100210c5
0x100210c8
0x100210cb
0x100210cb
0x10021064
0x1002106a
0x100210bb
0x100210bd
0x100210c0
0x100210c0
0x1002106c
0x1002106e
0x10021071
0x10021074
0x10021074
0x10021074
0x10021074
0x1002103d
0x1002103d
0x10021040
0x10021042
0x10021042
0x10021044
0x10021044
0x10021047
0x10021048
0x10021048
0x1002104c
0x00000000
0x00000000
0x00000000
0x00000000
0x10020fbb
0x10020fc1
0x10020fc6
0x00000000
0x10020fc8
0x10020fc8
0x10020fcc
0x10020fce
0x10020fd2
0x10020fd5
0x10020fd7
0x10021078
0x1002107e
0x100210f4
0x100210f7
0x100210fa
0x100210fb
0x100210ff
0x10021106
0x10021106
0x10021080
0x10021086
0x100210e2
0x100210e5
0x100210e8
0x100210eb
0x100210ee
0x100210ee
0x10021088
0x1002108e
0x10021094
0x10021096
0x10021099
0x1002109c
0x1002109f
0x1002109f
0x1002108e
0x10020fdd
0x10020fdd
0x10020fe3
0x10020fe7
0x10020feb
0x10020fef
0x10020fef
0x10020ff1
0x10020ff4
0x10020ff4
0x10020fc6
0x10020ff9
0x10021007
0x10021009
0x10021009
0x10021009
0x10021009
0x10020fa0
0x1002100f
0x10021013
0x1002101c
0x1002101c
0x10021026
0x10021026
0x10020ec8
0x00000000
0x00000000
0x00000000
0x00000000
0x10020d93
0x00000000
0x10020bbe
0x10020bbe
0x10020bc6
0x10020bc8
0x10020bcb
0x10020bce
0x10020bd2
0x00000000
0x10020bd8
0x10020bd8
0x10020bdb
0x10020c3b
0x10020c3b
0x10020c46
0x10020c4a
0x10020c4c
0x10020c56
0x10020c56
0x10020c59
0x10020c61
0x10020c68
0x10020c6a
0x10020c6a
0x10020c6c
0x10020c70
0x10020c76
0x10020c7d
0x10020c7e
0x10020c83
0x10020c8c
0x10020c93
0x10020c96
0x10020c9d
0x10020ca4
0x00000000
0x00000000
0x10020caa
0x10020cad
0x10020cba
0x10020cba
0x10020cbc
0x00000000
0x10020cc2
0x10020cc2
0x10020cc4
0x10020dc8
0x10020dc8
0x10020dcb
0x10020dcd
0x10020dd0
0x10020df4
0x10020df6
0x10020e06
0x10020e06
0x10020dd2
0x10020dd2
0x10020dd5
0x10020de3
0x10020de3
0x10020dd5
0x10020cca
0x10020cca
0x10020cd0
0x00000000
0x10020cd6
0x10020cde
0x10020cde
0x10020ce0
0x10020ce0
0x10020cd0
0x10020ce3
0x10020cea
0x10020cee
0x10020cf0
0x10020cf0
0x10020cf3
0x10020cf6
0x10020cf6
0x10020cfa
0x10020d05
0x10020d08
0x10020d0e
0x10020d14
0x10020d1f
0x10020d2a
0x10020d35
0x10020d3d
0x10020d48
0x10020d4c
0x10020d4d
0x10020d51
0x10020d55
0x10020d58
0x10020d5c
0x10020d65
0x10020d67
0x00000000
0x10020d6d
0x10020d6d
0x10020d71
0x00000000
0x10020d71
0x10020d67
0x10020caf
0x10020caf
0x10020cb4
0x00000000
0x00000000
0x00000000
0x00000000
0x10020cb4
0x00000000
0x10020cad
0x00000000
0x10020bdd
0x10020bdd
0x10020be0
0x10020be3
0x10020be7
0x10020be9
0x10020bec
0x10020bf0
0x10020bf3
0x00000000
0x10020bf9
0x10020bf9
0x10020bfc
0x00000000
0x10020bfe
0x10020bfe
0x10020c01
0x10020c04
0x10020c08
0x10020c0a
0x10020c0d
0x10020c11
0x10020c14
0x00000000
0x10020c1a
0x10020c1a
0x10020c1d
0x00000000
0x10020c1f
0x10020c1f
0x10020c22
0x10020c25
0x10020c29
0x10020c2b
0x10020c2e
0x10020c32
0x10020c35
0x00000000
0x00000000
0x00000000
0x00000000
0x10020c35
0x10020c1d
0x10020c14
0x10020bfc
0x10020bf3
0x10020bdb
0x10020bd2
0x10020bb8
0x10020bac
0x10020b95
0x10020b83
0x10020919
0x10020925
0x10020927
0x10020935
0x10020937
0x1002093d
0x10020941
0x10020946
0x1002094a
0x1002095c
0x1002095e
0x10020962
0x10020968
0x00000000
0x00000000
0x1002096e
0x10020974
0x1002097f
0x1002098d
0x10020994
0x100209be
0x100209c1
0x100209c3
0x100209c5
0x100209c7
0x100209cb
0x10020a3b
0x10020a3e
0x10020a41
0x10020a43
0x10020a43
0x100209d3
0x10020a20
0x10020a23
0x10020a26
0x10020a29
0x10020a2c
0x10020a2c
0x100209db
0x100209dd
0x100209df
0x100209e2
0x100209e5
0x100209e8
0x100209e8
0x100209db
0x100209a0
0x100209a0
0x100209a6
0x100209aa
0x100209b4
0x100209b6
0x100209b8
0x100209f4
0x100209fb
0x100209fb
0x100209fb
0x10020a02
0x10020a02
0x10020a03
0x10020a07
0x10020a09
0x10020a0c
0x10020a54
0x10020a5d
0x10020a0e
0x10020a0e
0x10020a13
0x10020a13
0x10020a13
0x10020a15
0x00000000
0x10020a15
0x10020a68
0x10020a6c
0x10020a70
0x10020a7d
0x10020a80
0x10020a82
0x10020a89
0x10020a89
0x10020a90
0x10020a96
0x10020a99
0x10020a9c
0x10020a9c
0x10020a90
0x10020aa3
0x10020aac
0x00000000
0x10020aac
0x1002094a
0x10020913
0x00000000

APIs

mv_image_get_buffer_size.MAIN ref: 10020869

Part of subcall function 10020660: mv_pix_fmt_desc_get.MAIN ref: 1002067F
Part of subcall function 10020660: mv_image_get_linesize.MAIN ref: 100206B4
Part of subcall function 10020660: mv_image_fill_linesizes.MAIN(?), ref: 10020748
Part of subcall function 10020660: mv_image_fill_plane_sizes.MAIN(?), ref: 100207AB

mv_pix_fmt_desc_get.MAIN ref: 10020873
mv_image_fill_linesizes.MAIN ref: 1002090C
mv_log.MAIN ref: 10020AE8
abort.MSVCRT ref: 10020AED
mv_pix_fmt_desc_get.MAIN ref: 10020B14
mv_pix_fmt_count_planes.MAIN ref: 10020B1E

Strings

Assertion %s failed at %s:%d, xrefs: 10020AE0
, xrefs: 10021013

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get$mv_image_fill_linesizes$abortmv_image_fill_plane_sizesmv_image_get_buffer_sizemv_image_get_linesizemv_logmv_pix_fmt_count_planes
String ID: $Assertion %s failed at %s:%d
API String ID: 1281078460-3513380740
Opcode ID: c6aa44ff7cc2dd3ec536464cbf8ee4c7033008b01ecee55ae96f81af4c4c6a53
Instruction ID: 773bde96130699db78e658d80479c0383b6257f66772b6af4f59ee2ed46427a0
Opcode Fuzzy Hash: c6aa44ff7cc2dd3ec536464cbf8ee4c7033008b01ecee55ae96f81af4c4c6a53
Instruction Fuzzy Hash: E9427E75A083858FC760CF28D48069EBBE2FFC8354F96892DF99997312D771E9418B42

Uniqueness

Uniqueness Score: -1.00%

Function 10013100 Relevance: 22.6, APIs: 15, Instructions: 142COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 10013116
mv_mallocz.MAIN ref: 10013128
mv_mallocz.MAIN ref: 10013154
mv_mallocz.MAIN ref: 100131C3
mv_calloc.MAIN ref: 100132A0

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_calloc
String ID:
API String ID: 1417229449-0
Opcode ID: 11c5df3fdc17ecbdb580f76e82102d0b651416b72ae8ebbfb0f71fad63a734a3
Instruction ID: 5eac887c21a6c61861bed7af62f95aa57474651100df0996b3e61034f298f0f1
Opcode Fuzzy Hash: 11c5df3fdc17ecbdb580f76e82102d0b651416b72ae8ebbfb0f71fad63a734a3
Instruction Fuzzy Hash: 4151F574605B529BC750EF69D88061AF7E0FF48794F42892CE9958B309EB34F890CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1002C428 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 134COMMON

Download Yara Rule

APIs

mv_opt_find2.MAIN ref: 1002C491
mv_expr_parse_and_eval.MAIN ref: 1002C5F5

Strings

none, xrefs: 1002C54A
max, xrefs: 1002C505
default, xrefs: 1002C4D2
min, xrefs: 1002C51F
all, xrefs: 1002C56F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_parse_and_evalmv_opt_find2
String ID: all$default$max$min$none
API String ID: 1085414910-3292705889
Opcode ID: 05f116ab4216a71b82e377bc1341495c5a2543e1ca9045ea53113bbb773d4fbb
Instruction ID: 18531c70e26c900463f27e75ba25a0c49568f7c26c871f4daec10b5f5a2a946d
Opcode Fuzzy Hash: 05f116ab4216a71b82e377bc1341495c5a2543e1ca9045ea53113bbb773d4fbb
Instruction Fuzzy Hash: FD512574A097458BC391EF68E04079BBBE5FFC9354F618A2EE8C8C7200EB71D8448B42

Uniqueness

Uniqueness Score: -1.00%

Function 10012A70 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 10012A96
mv_mallocz.MAIN ref: 10012AA8
mv_mallocz.MAIN ref: 10012AB6
mv_calloc.MAIN ref: 10012ACD

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_calloc
String ID:
API String ID: 1417229449-0
Opcode ID: 120c092516309b251ece8b0e79d11a8b170fe8de52fc652575ee7012228408d0
Instruction ID: 92956a2d1d3baa5ba05d42f33decdb2ad021b9d4684d2735edf6a3dd4ed8fbb8
Opcode Fuzzy Hash: 120c092516309b251ece8b0e79d11a8b170fe8de52fc652575ee7012228408d0
Instruction Fuzzy Hash: 0421F4B89087508BCB44DF2595C011BBBE0FF88654F82496DED849B30AE734EA61CB86

Uniqueness

Uniqueness Score: -1.00%

Function 1000D910 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000DA4E
mv_bprint_chars.MAIN ref: 1000DAA5
mv_channel_layout_describe_bprint.MAIN ref: 1000DAB5
mv_log.MAIN ref: 1000DB8E
abort.MSVCRT ref: 1000DB93

Strings

ambisonic %d, xrefs: 1000DA42

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_bprint_charsmv_bprintfmv_channel_layout_describe_bprintmv_log
String ID: ambisonic %d
API String ID: 3836754782-1019176007
Opcode ID: b34a5ce10fbd8834e3f4ae1ba03fa64c57cec5e69a3d579a25b9253d3ac1963c
Instruction ID: fcb70f02e0754f6f7d847351f1522eb27181b5797a445abb94d138a7096ea4de
Opcode Fuzzy Hash: b34a5ce10fbd8834e3f4ae1ba03fa64c57cec5e69a3d579a25b9253d3ac1963c
Instruction Fuzzy Hash: B66182B3B246054BE704DE28C88135DB6D2EBD8274F0DC63EE98AD7749EA34DD418792

Uniqueness

Uniqueness Score: -1.00%

Function 10013480 Relevance: 9.3, APIs: 6, Instructions: 286COMMON

Download Yara Rule

APIs

mv_encryption_init_info_alloc.MAIN ref: 10013562

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_encryption_init_info_alloc
String ID:
API String ID: 3189372936-0
Opcode ID: 40eb082df2a873b27e792bc7caffd1106743bd01b0e16bd1d615b7bb6c7bfb03
Instruction ID: a1e043498c3c16070c5ce0a7d842a7d55674a9d60fbffb8ceeaa7ba958246eb1
Opcode Fuzzy Hash: 40eb082df2a873b27e792bc7caffd1106743bd01b0e16bd1d615b7bb6c7bfb03
Instruction Fuzzy Hash: ACB169B1A083418FC764CF29C58461BFBE2FFC8254F56896DE9899B350E731E981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 10028590 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 267stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10028711

Strings

INT64_MAX, xrefs: 10028886
%d:%02d.%06d, xrefs: 10028700
INT64_MIN, xrefs: 100288C6
%lld:%02d:%02d.%06d, xrefs: 10028866
%d.%06d, xrefs: 100288F3

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strlen
String ID: %d.%06d$%d:%02d.%06d$%lld:%02d:%02d.%06d$INT64_MAX$INT64_MIN
API String ID: 39653677-2240581584
Opcode ID: 5ea261cdb59da726b0206cc8ad8b11822e12deeae5e592c96d0b6b2e14b3df2d
Instruction ID: c54e951a0f1896a6386a6c5c1f669f1c3c64ce07789a61242c38440661c84367
Opcode Fuzzy Hash: 5ea261cdb59da726b0206cc8ad8b11822e12deeae5e592c96d0b6b2e14b3df2d
Instruction Fuzzy Hash: A8A16D76A193118FC308CF6DC44421EFBE6EBC8350F998A2EF488D7364DA74D9058B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000C9F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

%d channels, xrefs: 1000CAF8

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %d channels
API String ID: 0-1351059727
Opcode ID: 125e0846f57f9b032cdce6562afb1258b5259d1002a50140fed6246712bc4ce9
Instruction ID: fbd93282e394e78ed831cdfa1163249771b383e02731abb89eb949a6102d5748
Opcode Fuzzy Hash: 125e0846f57f9b032cdce6562afb1258b5259d1002a50140fed6246712bc4ce9
Instruction Fuzzy Hash: 5551B776B147458BD308DF68D85121EB7E2FBD43A0F58C82DE586C7345DA35ED428782

Uniqueness

Uniqueness Score: -1.00%

Function 10004C96 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

4, xrefs: 10005E70

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: f23844b4878ae76a0b3aac12f5f256e7d55f5c1c7e8f5e7ac4fbb783080d59ea
Instruction ID: 08fb163c5819d7295cc8aa6fec952d718ba34be413da047925ed918ae5f07aa1
Opcode Fuzzy Hash: f23844b4878ae76a0b3aac12f5f256e7d55f5c1c7e8f5e7ac4fbb783080d59ea
Instruction Fuzzy Hash: D3022B30A18B84CBE375CF24C88475BB7E2FF85381F218B1ED48A97259E7719885DB52

Uniqueness

Uniqueness Score: -1.00%

Function 10007270 Relevance: 6.3, APIs: 4, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355135263088e94a10b3081d7ca45438585c75b071c068879c5feec0f380323f
Instruction ID: 51e70f272ae0093965207845ec1cb951f05259167ff59344558e7544d7b47f58
Opcode Fuzzy Hash: 355135263088e94a10b3081d7ca45438585c75b071c068879c5feec0f380323f
Instruction Fuzzy Hash: 69C19E71A087858BD350CF2D888064EBBE1FFC9294F198A2EF9D8C7355E675D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 10020B00 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 10020B14
mv_pix_fmt_count_planes.MAIN ref: 10020B1E
mv_write_image_line.MAIN(?), ref: 10020D5C
mv_image_get_linesize.MAIN ref: 10020DA4

Strings

Assertion %s failed at %s:%d, xrefs: 10020AE0
, xrefs: 10021013

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_get_linesizemv_pix_fmt_count_planesmv_pix_fmt_desc_getmv_write_image_line
String ID: $Assertion %s failed at %s:%d
API String ID: 2742463661-3513380740
Opcode ID: dfac4c9c3e2b2a6659d2d83ec8970682280816447ca476019a7c42da2599a3de
Instruction ID: 7291b42ecfa30c9ded9631a3f5ec54be9a0a2bb908f309bcd4ce331d09022d6a
Opcode Fuzzy Hash: dfac4c9c3e2b2a6659d2d83ec8970682280816447ca476019a7c42da2599a3de
Instruction Fuzzy Hash: 0F7129759093458BC761DF69E48029AFBE2FFC8354F968D2EE899C7211D770E8408B82

Uniqueness

Uniqueness Score: -1.00%

Function 1009E390 Relevance: 6.1, APIs: 4, Instructions: 120timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 1009E3C6
GetSystemTimeAsFileTime.KERNEL32 ref: 1009E468
_errno.MSVCRT ref: 1009E4E6
_errno.MSVCRT ref: 1009E516

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: eb795a304289e64b422f20939e939fd83203c3a050f27a67b90a55001f882086
Instruction ID: a6a4ef0f4dcf97e1d99c5454615c768c8d757491a9aa12e503df49880ea70f1b
Opcode Fuzzy Hash: eb795a304289e64b422f20939e939fd83203c3a050f27a67b90a55001f882086
Instruction Fuzzy Hash: BC4189716087548FC754DF79C98461ABBE5FBC8750F118A2EEAA887350E770ED448B82

Uniqueness

Uniqueness Score: -1.00%

Function 10003BA5 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

p, xrefs: 10003E93

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: d6c04680bbe955c103b7f436529c0503f7f06eeb2c18b2d83b470fdf05ea0d0b
Instruction ID: 1ca8311a87ccc67d6bca6b791013ec31f3dc8583ffc9e9a3a8608dd72f8d1e18
Opcode Fuzzy Hash: d6c04680bbe955c103b7f436529c0503f7f06eeb2c18b2d83b470fdf05ea0d0b
Instruction Fuzzy Hash: E4422774A083908FE374CF29C490B9BB7E2FFC9290F558A2ED98997355D7709841CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1008F660 Relevance: 4.6, APIs: 3, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 1008F681

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 911fbccf3e6d103ec169fe48f33fd043b6d4840403c0ea04d5ce06a0aebe5803
Instruction ID: 644768b22c3724b228d8b808f31f7f684975bc292c311e4257fcfe74704407b1
Opcode Fuzzy Hash: 911fbccf3e6d103ec169fe48f33fd043b6d4840403c0ea04d5ce06a0aebe5803
Instruction Fuzzy Hash: D32125B08093119FDB10EF34D5C936ABBE0FF88354F018A2DE88587254E778D884CB52

Uniqueness

Uniqueness Score: -1.00%

Function 10012CF0 Relevance: 4.5, APIs: 3, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eea2f9685ca08747ffed188d0de6a7b02632913073af7642ad7773e43fe3f59
Instruction ID: 91a719c03da17c05ada23154b761e27d52727ca7cd1dfe88b75f4473b2909254
Opcode Fuzzy Hash: 8eea2f9685ca08747ffed188d0de6a7b02632913073af7642ad7773e43fe3f59
Instruction Fuzzy Hash: 87E059B45087518BCB00EF68D4C141ABBE0FF5C248F85495DAA844B31BE634E5548BE7

Uniqueness

Uniqueness Score: -1.00%

Function 1004B2A5 Relevance: 4.0, Strings: 3, Instructions: 241COMMON

Download Yara Rule

Strings

gfff, xrefs: 1004B3FC
gfff, xrefs: 1004B48C
gfff, xrefs: 1004B311

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: gfff$gfff$gfff
API String ID: 0-4275324669
Opcode ID: 268b3e8c4049cf9f0418b796dedf1257a26545202377507e9ea087931b81b73a
Instruction ID: d59a2d3ae2d3648ea39482ecc8a01c73a7ed0aed4c874a4a860ecf1c914a34e2
Opcode Fuzzy Hash: 268b3e8c4049cf9f0418b796dedf1257a26545202377507e9ea087931b81b73a
Instruction Fuzzy Hash: EE71A632B047164BD758CE2ECD8020ABBD7EBC8350F598A3DE599DB394DA70ED158B81

Uniqueness

Uniqueness Score: -1.00%

Function 10013860 Relevance: 3.2, APIs: 2, Instructions: 222COMMON

Download Yara Rule

APIs

mv_malloc.MAIN ref: 10013AE8

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_malloc
String ID:
API String ID: 3797683224-0
Opcode ID: d0f46ac01df2d66eedf7921aeb8116c9143c8572b1c9a41cb75b5c2ebe5f539e
Instruction ID: d9cd303cd0cdd735b109894e0513b1deaf0e71c410b9c65df79ef7a199e1e6cc
Opcode Fuzzy Hash: d0f46ac01df2d66eedf7921aeb8116c9143c8572b1c9a41cb75b5c2ebe5f539e
Instruction Fuzzy Hash: B3718CB2A042568BCB14CF28C88175AB7E2FF84354F66C568ED899F341E671ED81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 100084B0 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

mv_blowfish_crypt_ecb.MAIN ref: 10008642

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_blowfish_crypt_ecb
String ID:
API String ID: 997994871-0
Opcode ID: e25778ea9fdb925930b24f7ee5b61e2c5b198a0ae9bacbd401b09897083a4e10
Instruction ID: d8ffb9ab9be6425fb2f2151958634ca33b63df147d529954a2eeef9d18f7c60e
Opcode Fuzzy Hash: e25778ea9fdb925930b24f7ee5b61e2c5b198a0ae9bacbd401b09897083a4e10
Instruction Fuzzy Hash: 537145B19097818BC709CF29D5C846AFBE1FFC9245F118A5EE8DC87344E270AA04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 100218A0 Relevance: 2.2, APIs: 1, Instructions: 724COMMON

Download Yara Rule

APIs

mv_mod_i.MAIN ref: 10022129

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mod_i
String ID:
API String ID: 416848386-0
Opcode ID: a8d4099fe6c0eb055b727cce64fe07889f2056542eb8a35ea18b6c28ee92d382
Instruction ID: 1978e8aa041b561afe43b5e1e9d69cc5e5589bc87bfac444af9f8de18395159f
Opcode Fuzzy Hash: a8d4099fe6c0eb055b727cce64fe07889f2056542eb8a35ea18b6c28ee92d382
Instruction Fuzzy Hash: CE623875A083A18BD324CF69C04066EF7E2FFC8750F568A1EE9D997390D774A840CB96

Uniqueness

Uniqueness Score: -1.00%

Function 10023D50 Relevance: 2.0, APIs: 1, Instructions: 473COMMON

Download Yara Rule

APIs

mv_memcpy_backptr.MAIN ref: 10023E04

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_memcpy_backptr
String ID:
API String ID: 3283147377-0
Opcode ID: 82edd6c9b28d5e3e87d5fc8225cc50ae9901fcbf316564df120b2eb5d842609a
Instruction ID: a803e6f6b0ad9f32406ee31b4673f51b83a2fac15321978e025a3434044aa702
Opcode Fuzzy Hash: 82edd6c9b28d5e3e87d5fc8225cc50ae9901fcbf316564df120b2eb5d842609a
Instruction Fuzzy Hash: 9F02B271A083528FC714CF25E48025AF7F1FF88348F96897DED899B251D771EA498B81

Uniqueness

Uniqueness Score: -1.00%

Function 10032890 Relevance: 1.9, APIs: 1, Instructions: 385COMMON

Download Yara Rule

APIs

mv_gcd.MAIN ref: 1003292D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_gcd
String ID:
API String ID: 2848192316-0
Opcode ID: 94c61de4151f85b2e349843c83d37783726b6990a1d380f2b046a8bb30d58925
Instruction ID: bae91829bd6a7d55044bc074d33ea4c9e53b069e54380698bce3da439848f8c3
Opcode Fuzzy Hash: 94c61de4151f85b2e349843c83d37783726b6990a1d380f2b046a8bb30d58925
Instruction Fuzzy Hash: A3F1CE75A083518FC358CF2AC48061AFBE6BFC8750F559A2EF998D7360D670E8458F82

Uniqueness

Uniqueness Score: -1.00%

Function 1001EAB0 Relevance: 1.8, APIs: 1, Instructions: 297COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get
String ID:
API String ID: 2427544746-0
Opcode ID: b892691f4f349c96ba1384667e915caf21722faef09a2027f66083ef5ed52c75
Instruction ID: 783a62940874baa8ec3945e1bd9358386c9619e9dd1953521893957c1d9dab46
Opcode Fuzzy Hash: b892691f4f349c96ba1384667e915caf21722faef09a2027f66083ef5ed52c75
Instruction Fuzzy Hash: BDA1D27070839A8FD748DF29C85166EBBD1EB84350F154A3EE866CF791EA31ED858B40

Uniqueness

Uniqueness Score: -1.00%

Function 1002B270 Relevance: 1.7, APIs: 1, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_d2q.MAIN ref: 1002B5CC

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_d2q
String ID:
API String ID: 1563177686-0
Opcode ID: dbf8743510c8fbbd616d23bfe24ff011681c019d3911d58527e69379db29e0a2
Instruction ID: 1f0a7b361e8469cdb879426936d90b34354dbc15308211f32f0c3676d5f7708e
Opcode Fuzzy Hash: dbf8743510c8fbbd616d23bfe24ff011681c019d3911d58527e69379db29e0a2
Instruction Fuzzy Hash: 19715C34608F46CFC356DF38D08060AF7B1FF86340F968B99E9566B256EB31E8859B41

Uniqueness

Uniqueness Score: -1.00%

Function 10012D40 Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

mv_encryption_info_alloc.MAIN ref: 10012DD5

Part of subcall function 10012A70: mv_mallocz.MAIN ref: 10012A96
Part of subcall function 10012A70: mv_mallocz.MAIN ref: 10012AA8
Part of subcall function 10012A70: mv_mallocz.MAIN ref: 10012AB6
Part of subcall function 10012A70: mv_calloc.MAIN ref: 10012ACD

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_callocmv_encryption_info_alloc
String ID:
API String ID: 3322142038-0
Opcode ID: 42a5be7598cb39ad7791f87488e6a70f642197d01b399c05ab6afc0b11886a48
Instruction ID: 564550559dc25ff60d170d57d2507b8afd000e4bbd60ef45d364b311c6fa6347
Opcode Fuzzy Hash: 42a5be7598cb39ad7791f87488e6a70f642197d01b399c05ab6afc0b11886a48
Instruction Fuzzy Hash: B1517CB2E042118BC704CF19C48461AFBE2FFE8354F26856DD88CAB315E674EDA5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1001363B Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

mv_encryption_init_info_alloc.MAIN ref: 10013562

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_encryption_init_info_alloc
String ID:
API String ID: 3189372936-0
Opcode ID: cd6924afccd7b87e315566fc0b34ac7627ccdbad5b7df46105264a39c2b01be1
Instruction ID: 78d0e82bed4cec982bfd679939fa63163902b3eee1ff480991edcad54221ee49
Opcode Fuzzy Hash: cd6924afccd7b87e315566fc0b34ac7627ccdbad5b7df46105264a39c2b01be1
Instruction Fuzzy Hash: 1951F5B1A087419FC744CF29C58451ABBE2FFC8654F56CA2DF889A7350D731ED458B82

Uniqueness

Uniqueness Score: -1.00%

Function 100136FB Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

mv_encryption_init_info_alloc.MAIN ref: 10013562

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_encryption_init_info_alloc
String ID:
API String ID: 3189372936-0
Opcode ID: ef5d398cf4f7091da99b035e9d0245d92d88978e73b2c3d1eb8e068e5064dbea
Instruction ID: 95a8c643b77e51546d68e8d33e3f4ed292e5d24ad01eeb6ce01257d6c0bf5d32
Opcode Fuzzy Hash: ef5d398cf4f7091da99b035e9d0245d92d88978e73b2c3d1eb8e068e5064dbea
Instruction Fuzzy Hash: 2D5128B1A087419FC744CF29C58461AFBE2FFC8654F56C92DE889AB350D731ED428B82

Uniqueness

Uniqueness Score: -1.00%

Function 10002480 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

mv_aes_crypt.MAIN ref: 10002554

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_aes_crypt
String ID:
API String ID: 1547198422-0
Opcode ID: a76755bfb4d6463656838ecde433fd04cde547babbb3dbb5163c6ebd5a4d3b10
Instruction ID: 6533aa27bc2eace4d46e94b1d96a72d5c0883edd5f4be066e5c3eb9db2eb8fbd
Opcode Fuzzy Hash: a76755bfb4d6463656838ecde433fd04cde547babbb3dbb5163c6ebd5a4d3b10
Instruction Fuzzy Hash: 81419D3510D7C18FD301CF69848054AFFE1FF99288F198A6DE8D993306D260EA09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1000EAC0 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

mv_channel_layout_index_from_string.MAIN ref: 1000EAD6

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_index_from_string
String ID:
API String ID: 1941520394-0
Opcode ID: b5427e202f8ac7429ec52a8e90e2a2ab38b9bd65bff75006616c9072962c14a1
Instruction ID: dd8c77e47ba7934b60b61c42e329a9640ddafb1186b5f9bdd33cfe49ccecab15
Opcode Fuzzy Hash: b5427e202f8ac7429ec52a8e90e2a2ab38b9bd65bff75006616c9072962c14a1
Instruction Fuzzy Hash: 6331E4B7F1476A0BE7209999DCC0216B3C0EB88270B4E863DDE5AA7786F551BD1582C1

Uniqueness

Uniqueness Score: -1.00%

Function 10012B40 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

mv_encryption_info_alloc.MAIN ref: 10012B5E

Part of subcall function 10012A70: mv_mallocz.MAIN ref: 10012A96
Part of subcall function 10012A70: mv_mallocz.MAIN ref: 10012AA8
Part of subcall function 10012A70: mv_mallocz.MAIN ref: 10012AB6
Part of subcall function 10012A70: mv_calloc.MAIN ref: 10012ACD

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_callocmv_encryption_info_alloc
String ID:
API String ID: 3322142038-0
Opcode ID: 0d1d6d985499e695549cee1dfdc865532ac4685cf5ab5fd08e705158918137f9
Instruction ID: 70bb560b92b21ff9a949702552601914469cb58a4fc0686d30597e3817c1d297
Opcode Fuzzy Hash: 0d1d6d985499e695549cee1dfdc865532ac4685cf5ab5fd08e705158918137f9
Instruction Fuzzy Hash: 19418DF69082518BD714CF14C5D162BBBA2FF94310F6686A8CE890F309E335E9E1D790

Uniqueness

Uniqueness Score: -1.00%

Function 10002523 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

mv_aes_crypt.MAIN ref: 10002554

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_aes_crypt
String ID:
API String ID: 1547198422-0
Opcode ID: 3928a72eaf0bdf75db777ef61b97453f1547db555a5c878ed5744eb0c7f909a7
Instruction ID: b15eea7d1e62e16a03610dfd725cbd08b0199710858140edd711ee624ae9ea9b
Opcode Fuzzy Hash: 3928a72eaf0bdf75db777ef61b97453f1547db555a5c878ed5744eb0c7f909a7
Instruction Fuzzy Hash: DC31C47610D7C18FD302CB6990C0099FFE1FF99248F198AADE4DD93706D264EA19CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1000867B Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

mv_blowfish_crypt_ecb.MAIN ref: 100086C2

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_blowfish_crypt_ecb
String ID:
API String ID: 997994871-0
Opcode ID: acf8950ea6c148c44c64157bc22eca501f0550abc9d144bf7c67352d16790dd9
Instruction ID: 3ce9d50094e6346554c2820e15aae8c95f0dca09f8e32c6084807ed2f7b375be
Opcode Fuzzy Hash: acf8950ea6c148c44c64157bc22eca501f0550abc9d144bf7c67352d16790dd9
Instruction Fuzzy Hash: 26019DB59093448FC709CF18E48842AFBE0FB8C355F11892EF8CCA7740E774AA448B46

Uniqueness

Uniqueness Score: -1.00%

Function 10010750 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010911

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: bcdcc6efd6621e1f85b7218b7b67dfd4e03329ea09515bb0419dbee41511919b
Instruction ID: 101352dd42f6db591cdfd1097ab698e3354d26ef9933b018def11634da6c13ef
Opcode Fuzzy Hash: bcdcc6efd6621e1f85b7218b7b67dfd4e03329ea09515bb0419dbee41511919b
Instruction Fuzzy Hash: AB613D76A187158FD308DF29D88025AF7E2FBC8310F49892DF999DB351E674EC059B82

Uniqueness

Uniqueness Score: -1.00%

Function 10010980 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010B38

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 5513a2eee4d2361defe977553411883ee58bb0119317c7a243b664d72bd759ad
Instruction ID: d0a6a35fac9b25aaf09e145393e53881d6b3ad243d3648f8ad8ecf29fe2e883f
Opcode Fuzzy Hash: 5513a2eee4d2361defe977553411883ee58bb0119317c7a243b664d72bd759ad
Instruction Fuzzy Hash: DB515976A187158FD308DF19C88025AF7E2FBC8350F4A892DE999DB351E670EC159B82

Uniqueness

Uniqueness Score: -1.00%

Function 10010778 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010911

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 0fa6dd96bcb8b49d32427fa14dca801b7d20183067ebe2f5af9251743fd18f1c
Instruction ID: 07c5791c45fa29d35386c44efcc7358132a53f75d1a9a2a1ef31ce81eb8ddbf6
Opcode Fuzzy Hash: 0fa6dd96bcb8b49d32427fa14dca801b7d20183067ebe2f5af9251743fd18f1c
Instruction Fuzzy Hash: F6513876A187158FD308DF19D88025AF7E2FBC8310F49892DFA999B351E774EC059B82

Uniqueness

Uniqueness Score: -1.00%

Function 1001099C Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010B38

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 456f62df167c221b4f35950558ada73559cb89ee4e5f1ccf327e946437bed8b3
Instruction ID: f07b37fba5f5260aea86cb94400ce6e638a8eff9ebd999678f623fdff0880617
Opcode Fuzzy Hash: 456f62df167c221b4f35950558ada73559cb89ee4e5f1ccf327e946437bed8b3
Instruction Fuzzy Hash: 97516B76A187158FD308DF19C88025AF7E2FBC8350F4A892DE999DB351D770EC159B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004B9F7 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

%02u:%02u:%02u%c%02u, xrefs: 1004BB30

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %02u:%02u:%02u%c%02u
API String ID: 0-3773705257
Opcode ID: 78d5b651179aeabf79ed4f1761ab9e79733903d6b9cf7f933123fa663cbc6650
Instruction ID: be87b99f198f806ac5ac68e7332846b2cd7fadfcf982dfc935bb2afe4e2f67bd
Opcode Fuzzy Hash: 78d5b651179aeabf79ed4f1761ab9e79733903d6b9cf7f933123fa663cbc6650
Instruction Fuzzy Hash: CE516BB1A087558FC754CF29C4806AAB7E2FBC8345F50492EF4C9C7392E675D909CB46

Uniqueness

Uniqueness Score: -1.00%

Function 100105C0 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

*, xrefs: 100106C6

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: f7bbd7721ca75eba7fa29301916c8371da0f62bce0992595b79b08e752eb8dc5
Instruction ID: c15c81efb2fd65274e57c9dcba0b9463b5106a8dfd25bbab1057f7fea26fdb11
Opcode Fuzzy Hash: f7bbd7721ca75eba7fa29301916c8371da0f62bce0992595b79b08e752eb8dc5
Instruction Fuzzy Hash: 94413CB6E083515FD340CE29C88125AF7E1EBC8754F5A892EF8D8DB351E674EC518B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004BBFB Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

%02u:%02u:%02u%c%02u, xrefs: 1004BCB7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %02u:%02u:%02u%c%02u
API String ID: 0-3773705257
Opcode ID: a9ff8266052fac096bbdaf9f8dff3345c5a2da32383e41417f63f1fb3d193ab2
Instruction ID: c2a482338d56ed2a3ef8511a491fbd6c9dcfefaef8d7b2b8c54ecd4e984975b1
Opcode Fuzzy Hash: a9ff8266052fac096bbdaf9f8dff3345c5a2da32383e41417f63f1fb3d193ab2
Instruction Fuzzy Hash: AC31D3759087668FE710CE15C4D139AB7E3EBC4341FA0893EE6844B393E639A54ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 10025550 Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db034cff99af1e7203ee44394934ffb7567196ced3806a0dc990b907df53bb
Instruction ID: aff783430aa08d586327c987e6b98b0e0f6b454682ab812075f4302f75d353d4
Opcode Fuzzy Hash: d6db034cff99af1e7203ee44394934ffb7567196ced3806a0dc990b907df53bb
Instruction Fuzzy Hash: D632503274471D4BC708EEE9DC811D5B3D2BB88614F49813C9E15D3706FBB8BA6A96C8

Uniqueness

Uniqueness Score: -1.00%

Function 10030741 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd6380a6ea4c78d65a7d71ee52a6b8ffee4365087ee231698d748b4880fdc6b
Instruction ID: 4b4ebc0a7281eede42f3b5a7b8291780f737a07bfc980894c4e29b3e9b1ce63d
Opcode Fuzzy Hash: 7fd6380a6ea4c78d65a7d71ee52a6b8ffee4365087ee231698d748b4880fdc6b
Instruction Fuzzy Hash: B9227B32A093568FC715DF29C89055AB7F1FF89316F19891DE9D99B210D230FE05DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1000B0D0 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33419a9aeb14ce56b4ab0fd1bc83750a17983b722cf78c8c468c2c97687aa838
Instruction ID: 3194deff8c1016480bd4981d57c44dc359412b19884f203e35b39e086724ce96
Opcode Fuzzy Hash: 33419a9aeb14ce56b4ab0fd1bc83750a17983b722cf78c8c468c2c97687aa838
Instruction Fuzzy Hash: D342DE756087409FC754CF29C58099AFBE2BFCE250F16C92EE899C7356D630E942CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100556F8 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e67863a46a38232c1c98f3bbb28cce13b0c6a915783b56d779cb3c3c48640e6
Instruction ID: 6d42d01cb552ea32de216882ba5b35338e805864c61f81a166e561337f25913f
Opcode Fuzzy Hash: 0e67863a46a38232c1c98f3bbb28cce13b0c6a915783b56d779cb3c3c48640e6
Instruction Fuzzy Hash: D5423F31A18F548EC327DF39C46066BF7A9BFDB280F01C71EE85A6B621DB31A5468741

Uniqueness

Uniqueness Score: -1.00%

Function 10066691 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ee1f807265c2448a5d30af4e3355bf754649fac8893e35c5f8cfddf926455e
Instruction ID: 7174ebee63d6dac74c7d8e3f892b5b6b3bbf86c4982769087327a44f26b8845a
Opcode Fuzzy Hash: 15ee1f807265c2448a5d30af4e3355bf754649fac8893e35c5f8cfddf926455e
Instruction Fuzzy Hash: C3422431928B498FC712CF7BC48016ABBE1BFDE340F29CB1AE95467275D730B4959A81

Uniqueness

Uniqueness Score: -1.00%

Function 10027681 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12ceeeddabea2a45ca0b25d6d0e56ab0a323e72b2d12a6fe70e262d570a28b0
Instruction ID: 571bd5867c6101fa5e645701067c2fbe670199725f1a45366c6b5ce0b233dcdc
Opcode Fuzzy Hash: e12ceeeddabea2a45ca0b25d6d0e56ab0a323e72b2d12a6fe70e262d570a28b0
Instruction Fuzzy Hash: A202D171A083458FC314CF28D48025ABBE2FFC6344F698A6ED9988F756D375D946CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10001C10 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23de68de42e9b2fff319b319bb0a95af41c36940e0026737b8edad38c2d5842e
Instruction ID: e56c4da3c65c3f53d07f449aff36a52800785b324c3280e25f20d128eee8fe3e
Opcode Fuzzy Hash: 23de68de42e9b2fff319b319bb0a95af41c36940e0026737b8edad38c2d5842e
Instruction Fuzzy Hash: 0412913050C3D18FD315CF29C4902AAFBE1EF8A354F1949AEE8D98B356D234EA45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1000AB30 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d71789e1cfc5ba619a513dd52caf5850fc783eb8f71c40b6a59df87316754b2
Instruction ID: 41af5d95f87fbfb2af461ad8df70ea3d515ec82b3f583ba1e2401cfb082bbbf6
Opcode Fuzzy Hash: 2d71789e1cfc5ba619a513dd52caf5850fc783eb8f71c40b6a59df87316754b2
Instruction Fuzzy Hash: C102A075A087119FD744CF29C58061BFBE2AFCC650F16C96AE898DB319D770EC428B92

Uniqueness

Uniqueness Score: -1.00%

Function 10024700 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff52c7ffbd1d9107fcbef65328e3878b9d8ec7e0a566bd5413746ddd724ee47a
Instruction ID: 17bda300cafbee541834c927e7bcf7240875502bd3d5a4043446c7d08037228a
Opcode Fuzzy Hash: ff52c7ffbd1d9107fcbef65328e3878b9d8ec7e0a566bd5413746ddd724ee47a
Instruction Fuzzy Hash: 84E10775B083408FC304CE29D88060AFBF6EFC9364F598A2DF999D73A1D671E9458B42

Uniqueness

Uniqueness Score: -1.00%

Function 100499A0 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8d4379c629bcd2e40492a2a49cc2a68a8e13a90f0cec3b32964914661c2c3e
Instruction ID: 68076dcebb193b58b9e24264a5a3b86d03840a9afd49eb0c7633087c8305a4f6
Opcode Fuzzy Hash: ce8d4379c629bcd2e40492a2a49cc2a68a8e13a90f0cec3b32964914661c2c3e
Instruction Fuzzy Hash: 63D1F2729183618BD710CE28C88136AB7E2EF85310F3989B9DC96CF356E335D845D795

Uniqueness

Uniqueness Score: -1.00%

Function 1000BC40 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431137dea47abea965a4c65ea2bae76a9fad497968b5ba94738f6492d779be4a
Instruction ID: 92a96264515353bbdb2fb3779fe61c75bca3e152c7aaefd779cf22f0e6c722ba
Opcode Fuzzy Hash: 431137dea47abea965a4c65ea2bae76a9fad497968b5ba94738f6492d779be4a
Instruction Fuzzy Hash: 82C19F32A04978CFD718DF19D8E486533A3EBE931174F86AED6425B3A5CA30BC15DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000B830 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2f94ac762cd677dc8362f514d4668eefae1739862ad9c7aa78fec698a4c789
Instruction ID: be10b61e0e400d7f3c7b246480c7663c1106f3f721ef33eb9267169c2a0f6ae4
Opcode Fuzzy Hash: 5a2f94ac762cd677dc8362f514d4668eefae1739862ad9c7aa78fec698a4c789
Instruction Fuzzy Hash: 1FC14D3160496CCFD75CEF29D8E48753393ABE831174B86ADD6034B3A5CA30B925DB94

Uniqueness

Uniqueness Score: -1.00%

Function 1004D583 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2f5e3a6e755b5cd1ec8c14b0b22a304fa7b3516a21b49beeeb033897322eaa
Instruction ID: 89953b31e04fa7be04450d99485250ae3be7f122ea8c091805a4f71ec7c47705
Opcode Fuzzy Hash: 8b2f5e3a6e755b5cd1ec8c14b0b22a304fa7b3516a21b49beeeb033897322eaa
Instruction Fuzzy Hash: CEC15F302087959FC741DF2AC4805A6FBF1EF9A200F49C55EE8D8CB346D634EA15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 10021340 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0655b07f9a60d7e6c93e24dd163bbcdd8dd7aa916f57eec32edbbdc4cc49b7
Instruction ID: 1db670544306bd251aebef4a7dbe6716f8247bd2a01bbc6002f53e6d6edf3967
Opcode Fuzzy Hash: ee0655b07f9a60d7e6c93e24dd163bbcdd8dd7aa916f57eec32edbbdc4cc49b7
Instruction Fuzzy Hash: 7BA14C745083168BD750DF16E4442AFF7E0FF94B84F958A2EF898DB250E234D981DB92

Uniqueness

Uniqueness Score: -1.00%

Function 1004E3E0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dad646239292c082a3e3cd6a8f2edab19a4e84d94e2075355bf024ee8a0388
Instruction ID: 14d1569ad32843df1e0f4a955a3229223ca10cf1b234f8bfe071cdd5ef662ba1
Opcode Fuzzy Hash: e2dad646239292c082a3e3cd6a8f2edab19a4e84d94e2075355bf024ee8a0388
Instruction Fuzzy Hash: 3CB128396083568FC754CF29C4C088BB7E2FF88314B66892DE959CB325E770F9558B85

Uniqueness

Uniqueness Score: -1.00%

Function 1004D5C1 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d016340bc325db1fd1648bbb37fa4be5db1333341c3535a9616d09fdc8b0c0ba
Instruction ID: 5b61de884d90df82446b19460e85b2eea36a0198e06777fdadc74bd29ad9c96a
Opcode Fuzzy Hash: d016340bc325db1fd1648bbb37fa4be5db1333341c3535a9616d09fdc8b0c0ba
Instruction Fuzzy Hash: DDB15F302087959FC745DF2AC4805A6FBF1AF9A200F89C55EE8D8CB347D634EA15DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10008144 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdca86bf5610cf8d83fc9a2a9123c7de6589e9a7e00ce3a8cca6f1a48dd3632
Instruction ID: 8c294614796abfce7a9b313687c0130c20c351539878b9b69ed8c38673feebb7
Opcode Fuzzy Hash: 0fdca86bf5610cf8d83fc9a2a9123c7de6589e9a7e00ce3a8cca6f1a48dd3632
Instruction Fuzzy Hash: 2DA134356002118FD398DE1FD8D0D6A7393ABC432DF5BC26E9E445B3AACD38B4669790

Uniqueness

Uniqueness Score: -1.00%

Function 10007A50 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930e695f6b8eca41130a53b596d6cf8baec4992ec9755c4dd3e6ab00923b5f85
Instruction ID: ebf589678dd2b21f450bef16afd8acf277a4c86fda3af18da15dd9d105d6ad1f
Opcode Fuzzy Hash: 930e695f6b8eca41130a53b596d6cf8baec4992ec9755c4dd3e6ab00923b5f85
Instruction Fuzzy Hash: 0CA13C70E003198FD39CDE1ED850E7A73A3AFC8229B8B865E95464F2F6DD346461C798

Uniqueness

Uniqueness Score: -1.00%

Function 10027CE0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb23b611c883a24b7dc64f5ed3ae72e36c28d5f49227ddd76db04b40012c1942
Instruction ID: 39ec7bd3f967f2fab41cbde095abb985c35da8c3921ffbb8da3c06d53bd0e8bf
Opcode Fuzzy Hash: fb23b611c883a24b7dc64f5ed3ae72e36c28d5f49227ddd76db04b40012c1942
Instruction Fuzzy Hash: E7816272B087019FC308CF29D59161AF7E7FBD8210F5AC53DA999CB3A5D674E8418B81

Uniqueness

Uniqueness Score: -1.00%

Function 1004A990 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdeefbb9b1cc8c6670991cf24b173620491e3b0587a273fc61fabb3fb5080e81
Instruction ID: f4f4e952c433a0949d58c36d6cc90477ad4d8c83a35f662541151486efee236c
Opcode Fuzzy Hash: cdeefbb9b1cc8c6670991cf24b173620491e3b0587a273fc61fabb3fb5080e81
Instruction Fuzzy Hash: 076190716093959FC701CF69848055AFBF1FF9A200F19896EE9D8D7342D330EA15CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1000E760 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7460696957a74314385251e6c6bcc12f45c6b26b427e07c74903d9ed9e685e2
Instruction ID: a9fd71970cc6ae0704401159e34ccb1fdaf457640d2c7af12330d1c819c8daf0
Opcode Fuzzy Hash: f7460696957a74314385251e6c6bcc12f45c6b26b427e07c74903d9ed9e685e2
Instruction Fuzzy Hash: 8941B173F2582507E7188828CC05319B2C3DBE4271B1EC37AED59EB789E934ED1686C2

Uniqueness

Uniqueness Score: -1.00%

Function 10001900 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95de5cfb7fefc0799c9c6931d173e6ec651f50519c43e477457960f263de7522
Instruction ID: a62b2dee07404cea211b2efb13baac961549e0bcf9cdcf768083b85999019a1a
Opcode Fuzzy Hash: 95de5cfb7fefc0799c9c6931d173e6ec651f50519c43e477457960f263de7522
Instruction Fuzzy Hash: B691D7755042628FDB40CF29C580692BBE1FF99320F5D85BAED989F31AD270A951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000FBC0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cead09edc808eba7652fd3d48dd65b28855fe963b82d9cdceffa72e781f375
Instruction ID: d4bf447c78ef34d846e3780bb63b59d672897940ec14c231ea6f15673d30e65f
Opcode Fuzzy Hash: 76cead09edc808eba7652fd3d48dd65b28855fe963b82d9cdceffa72e781f375
Instruction Fuzzy Hash: D451F433A209684BE304CD3ACC4079E72D3EBC4245F1EC77AD955CB64EDA74E9069780

Uniqueness

Uniqueness Score: -1.00%

Function 1000164B Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5339e86325d42bd6281c81f51f6f83cb80fe511d73c762a27f573bff63cef8
Instruction ID: 40aabe202a40184f6c89db9be28c5e271f9100c876ec067dbcd78a5b86649b1c
Opcode Fuzzy Hash: 2e5339e86325d42bd6281c81f51f6f83cb80fe511d73c762a27f573bff63cef8
Instruction Fuzzy Hash: 5681CD745042528FDB94CF29C5C0A96BBE1FF99310F5988B9ED9C8F61AE230A941DF60

Uniqueness

Uniqueness Score: -1.00%

Function 1004D3B0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b576644014d14f1c54322c87fd66bbfde8640324f1e42ad5ea2fc848f20d65e
Instruction ID: 3b5e75aad5a0c08e1416bd72158d909f1297ac2347114389bb20aec0d49765e5
Opcode Fuzzy Hash: 7b576644014d14f1c54322c87fd66bbfde8640324f1e42ad5ea2fc848f20d65e
Instruction Fuzzy Hash: 26516B71A043148FC314DF5AC480956B3E1FF8C218F8A896EDA855B363CB74B812CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1000EC10 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f31e89bf383224261359c19d973366952f6040810ff11a53915b1b7b06738d
Instruction ID: 7e8a3e0d9609ec9b68da2310c9f9daf873c96b394346dc03648b3db89d458a9c
Opcode Fuzzy Hash: e3f31e89bf383224261359c19d973366952f6040810ff11a53915b1b7b06738d
Instruction Fuzzy Hash: 3E318BB7B2574307E70C89A8DCE232892C1E76823078DC23EEB17D7787E454DD5A8642

Uniqueness

Uniqueness Score: -1.00%

Function 1000CD50 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6082cca1dc85545b64e55bf4046541dfc96b67093dd2ab0c149368fdd1ef0414
Instruction ID: e3fe650a6823e4e4dc9b535e6935c2817203043b6de3b1da7cd6ba713d0eb7c0
Opcode Fuzzy Hash: 6082cca1dc85545b64e55bf4046541dfc96b67093dd2ab0c149368fdd1ef0414
Instruction Fuzzy Hash: 8B3150F7F2692A03D31C441D9C11325A1C396E853075FC37EAE6AE77C6EC25AE1541C2

Uniqueness

Uniqueness Score: -1.00%

Function 1000DC10 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20aa1a2ed174444797f685eedafff3cac45e3a360d2fd9617722acb5f664a91e
Instruction ID: f0472b0e8e5d5ce24967d3d273812064255cadfc7dac72f8d46582de7e0842bc
Opcode Fuzzy Hash: 20aa1a2ed174444797f685eedafff3cac45e3a360d2fd9617722acb5f664a91e
Instruction Fuzzy Hash: 243146B3E1422A47E314E8089C80518F392EBD82B0B1FC376CD4DDB386E961AE45D6D0

Uniqueness

Uniqueness Score: -1.00%

Function 10021760 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e1bf70edc85c72b57ecd771a589712a2623989afca4d70576e69868d5c536e
Instruction ID: 9aaf14044436f1b2b42603b9fb6b72ce4f3e40e728a04a0e74472568190d7af2
Opcode Fuzzy Hash: 21e1bf70edc85c72b57ecd771a589712a2623989afca4d70576e69868d5c536e
Instruction Fuzzy Hash: 5E419866B0833196E314ABEDF4C049DF2E1FED1BA1B824A69D2952F141D330D449C7E7

Uniqueness

Uniqueness Score: -1.00%

Function 1000D060 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01961a118ebc83994ce737a496e9055b1f8ab46d9bbd015c8cfe35346e32c7fc
Instruction ID: 6d93bd8323a72235920ba6e149a4a7bae96c73b66a2dfad555009d0c6ff0ce4f
Opcode Fuzzy Hash: 01961a118ebc83994ce737a496e9055b1f8ab46d9bbd015c8cfe35346e32c7fc
Instruction Fuzzy Hash: 5311D2B3F2453203E71CD4199C2136D828387E82B071FC23FDE47A7286EC609D5682D1

Uniqueness

Uniqueness Score: -1.00%

Function 1000FA00 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16418492506d26e88d9ea5ffe778ecedbadd0674902667d5b4f3f091e616a9e4
Instruction ID: 959dd8b958685b2c602623f8f1487b2043f59aa88e98173f8505a8abe479dfa4
Opcode Fuzzy Hash: 16418492506d26e88d9ea5ffe778ecedbadd0674902667d5b4f3f091e616a9e4
Instruction Fuzzy Hash: 01214F33BA0CAB07D748CD7ACC823DA62D3E7C4209F49C6789556D7649D53DD8429680

Uniqueness

Uniqueness Score: -1.00%

Function 1000FAE0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3141d09b1683437dc047317c092a48923b199cea0971d17c0b8de08017b4ddf
Instruction ID: 7401ec26052bbdd11a75dd464f743d8617a1d02d8098354ba99e3f62ca5db7ec
Opcode Fuzzy Hash: f3141d09b1683437dc047317c092a48923b199cea0971d17c0b8de08017b4ddf
Instruction Fuzzy Hash: A8219D73F300320BC728CD7D8C5825662C1D7C8295B4E8BB9EE58EF786E668DD419AC0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C0B0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de151643a332339ce823666c471d4da1aa7b144928b0c7d3fd1e004a2c822b77
Instruction ID: 192b5b8e635135c3962563ef613f7b52fce4010c0b042699b34e9086fceffb22
Opcode Fuzzy Hash: de151643a332339ce823666c471d4da1aa7b144928b0c7d3fd1e004a2c822b77
Instruction Fuzzy Hash: 38316F651087D85ECB11CF3544904EABFE09EAB581B09C49EF8E84B247C524EB09EB71

Uniqueness

Uniqueness Score: -1.00%

Function 100101D0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78873d4f70a7114040ce7729ab5ab63925d14f9cd724e7e38f810f9ad5a330b
Instruction ID: 7615e6e647f5862a10f08712ea71b14590be4302af2179b17c0dfb1654340f57
Opcode Fuzzy Hash: c78873d4f70a7114040ce7729ab5ab63925d14f9cd724e7e38f810f9ad5a330b
Instruction Fuzzy Hash: FF2122726042658BCB14DE19C8D86AB73E2FBC9314F168A68E9C55F205C234F84ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 1000FAF7 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e8cd7bf255c7c8b941f54418a5bf7396c934417188cacc302b08a8026b8cc6
Instruction ID: e42923ef10120b0fce72e2dfd62ff0f6b1e92c6f034ab2fe8244b6ba9566043e
Opcode Fuzzy Hash: 21e8cd7bf255c7c8b941f54418a5bf7396c934417188cacc302b08a8026b8cc6
Instruction Fuzzy Hash: 2F115E73E301320BC724CD7D8C4834262C1D788256B4E8BB5DE98EF342E268ED429AC0

Uniqueness

Uniqueness Score: -1.00%

Function 1000AA10 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2855c1fd0bc473689ac7151c799de4b67eb7dbd14f8e375b0c1984da4defb2b2
Instruction ID: bb67aa5c3e79cddec5f4daef0c555e321a96bdb8e320fd3e56e053c9fc0aa2d4
Opcode Fuzzy Hash: 2855c1fd0bc473689ac7151c799de4b67eb7dbd14f8e375b0c1984da4defb2b2
Instruction Fuzzy Hash: 5A312DB1A146309BE358CF1AEDE462AF3E2E38C320F46416DD989933B1D9786C25C790

Uniqueness

Uniqueness Score: -1.00%

Function 100339C0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad436124cf0627712d9c57b5f9352303ce41f418a33c0e13c018656ee81bd46e
Instruction ID: d55ec0bf4d8ccb7feddbac453193f8db4f74bc196d46466865d676d0862984f4
Opcode Fuzzy Hash: ad436124cf0627712d9c57b5f9352303ce41f418a33c0e13c018656ee81bd46e
Instruction Fuzzy Hash: DC21AD3400D7E05EC712DB66809007AFFE1AE97112F09C9EEE8E84B383D1399204DB23

Uniqueness

Uniqueness Score: -1.00%

Function 1002A9E9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c76c69a6e16dc7822b4f5a1a757f8ccc5bafd5d8a12991ea2ea248d2ead5663
Instruction ID: cb6bd734151cd8d44044ce49627ebacfeb84b08cb3a248c712c7f8227f187652
Opcode Fuzzy Hash: 0c76c69a6e16dc7822b4f5a1a757f8ccc5bafd5d8a12991ea2ea248d2ead5663
Instruction Fuzzy Hash: 2321E471A08105DFCB68CF88E690A9DB7F5EF0A314FA00095E905AB612DB34EDC0EB56

Uniqueness

Uniqueness Score: -1.00%

Function 1001021B Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123d4edf2cae72c4cb44158153aca10c35860e83f93e9ec1453424ef70596d6d
Instruction ID: bcaa8491dccb865917a35a3d808823525e0e43ff59a73624eea8fea794acadd0
Opcode Fuzzy Hash: 123d4edf2cae72c4cb44158153aca10c35860e83f93e9ec1453424ef70596d6d
Instruction Fuzzy Hash: 141134326041618BCB15CE69C8D86AA73D2FBC9315F17C968E9C69F245C334F94ACBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1000ECC9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b3cff72a2fe030a4ed2511b45a548b940cb1d6c9d7d61aaa5361d334626fbb
Instruction ID: a76a18bd8d72b9e19a2e58a34af59ce664b239cd2ef53a40b3fd3bff6214917f
Opcode Fuzzy Hash: d0b3cff72a2fe030a4ed2511b45a548b940cb1d6c9d7d61aaa5361d334626fbb
Instruction Fuzzy Hash: E2011DE7B6170707D70C48A8DCE632892C1E36813078DC13EEB17D7783E4549E6A8642

Uniqueness

Uniqueness Score: -1.00%

Function 1000C1B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7d7dad83a973bb790b37e6832e95b579524e0ac113e1f4aa988c8562b958bd
Instruction ID: f8771a243a862af8759e5689c7b57640d36b1020b076dab7645bd5d8fe9118fc
Opcode Fuzzy Hash: ca7d7dad83a973bb790b37e6832e95b579524e0ac113e1f4aa988c8562b958bd
Instruction Fuzzy Hash: BDF0F676B1435947E900DF459C40B8BB7D9FFC42D8F16052EED48A3305C630BD0586A1

Uniqueness

Uniqueness Score: -1.00%

Function 1008B030 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566e91d0b8d452359c7bb78fe999ee31250548b62ca49a35f0ac2a50155920e7
Instruction ID: fb49bc79d4318df5132ff4e8978937c42cbf5c601f0cfd761cb428f5592a7514
Opcode Fuzzy Hash: 566e91d0b8d452359c7bb78fe999ee31250548b62ca49a35f0ac2a50155920e7
Instruction Fuzzy Hash: 19E0C9B62193159FE314DE09E8808A7FBECEBD8664B10492FF4C493300C231AC448BB1

Uniqueness

Uniqueness Score: -1.00%

Function 10001BF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc891dde5e5142dc419ac2e2b5c6ff9a8dc6ccd91bf6328c5a5782cc288a074
Instruction ID: 017239b7fcefab97b4c7b84e08d353cd020fbbd4a0174547befcb6416ae83df2
Opcode Fuzzy Hash: 9fc891dde5e5142dc419ac2e2b5c6ff9a8dc6ccd91bf6328c5a5782cc288a074
Instruction Fuzzy Hash: 91B00274508205DFC309CF04C1859D677E1BB98741F2589F9E55847226D27099459A92

Uniqueness

Uniqueness Score: -1.00%

Function 10017162 Relevance: 100.1, APIs: 56, Strings: 1, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_mallocz.MAIN ref: 10017236

Strings

Invalid chars '%s' at the end of expression '%s', xrefs: 1001726C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz
String ID: Invalid chars '%s' at the end of expression '%s'
API String ID: 1901900789-1422635149
Opcode ID: b9b5404f8f7a3a855f615fbe720d284632f6c1f76810d66ba6a38d70fdf3f15c
Instruction ID: bac24a0257c5d849bb0dbfe2b802779c263aec53df092acb8c93c3cd01452c15
Opcode Fuzzy Hash: b9b5404f8f7a3a855f615fbe720d284632f6c1f76810d66ba6a38d70fdf3f15c
Instruction Fuzzy Hash: CBE184B89097819FC780DF68C48191ABBF1FF88250F85586DF8C58B316E735E881CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10017261 Relevance: 98.3, APIs: 55, Strings: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E10017261(void* __eax, void* __ebx, void* __edi, intOrPtr __esi, char _a4, char* _a8, char* _a12, intOrPtr _a16, char _a48, char* _a52, char _a56, char _a60) {
				intOrPtr _t116;
				void* _t118;
				intOrPtr* _t120;

				_t116 = __esi;
				_a12 = __eax;
				__eax = "Invalid chars \'%s\' at the end of expression \'%s\'\n";
				__edx = 0x10;
				_a8 = "Invalid chars \'%s\' at the end of expression \'%s\'\n";
				__eax =  &_a60;
				_a16 = __ebx;
				_a4 = 0x10;
				 *__esp =  &_a60;
				__eax = E10023A40();
				_a48 = __edi;
				if(__edi != 0) {
					__eax =  *(__edi + 0x18);
					_a52 = __eax;
					if(__eax != 0) {
						__edx = __eax[0x18];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						__edx = __eax[0x1c];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						__edx = __eax[0x20];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						E100265C0(__eax);
						__eax =  &_a52;
						E100265C0( &_a52);
						__edi = _a48;
					}
					__eax =  *(__edi + 0x1c);
					_a52 = __eax;
					if(__eax == 0) {
						L22:
						__eax =  *(__edi + 0x20);
						_a52 = __eax;
						if(__eax == 0) {
							L30:
							E100265C0(__edi);
							__eax =  &_a48;
							E100265C0( &_a48);
							goto L1;
						}
						__edx = __eax[0x18];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						__edx = __eax[0x1c];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						__edx = __eax[0x20];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						E100265C0(__eax);
						__eax =  &_a52;
						E100265C0( &_a52);
						__edi = _a48;
						goto L30;
					} else {
						__edx = __eax[0x18];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						__edx = __eax[0x1c];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						__edx = __eax[0x20];
						_a56 = __edx;
						if(__edx != 0) {
							 *((intOrPtr*)(__edx + 0x18)) = E10015280( *((intOrPtr*)(__edx + 0x18)));
							_a56 =  *(_a56 + 0x1c);
							__eax = E10015280( *(_a56 + 0x1c));
							_a56 =  *(_a56 + 0x20);
							E10015280( *(_a56 + 0x20)) = _a56;
							__eax = _a56 + 0x24;
							E100265C0(_a56 + 0x24);
							__eax =  &_a56;
							E100265C0( &_a56);
							__eax = _a52;
						}
						E100265C0(__eax);
						__eax =  &_a52;
						E100265C0( &_a52);
						__edi = _a48;
						goto L22;
					}
				}
				L1:
				 *_t120 = _t116;
				L100265B0();
				return _t118;
			}

0x10017261
0x10017268
0x1001726c
0x10017271
0x10017276
0x1001727a
0x1001727e
0x10017282
0x10017286
0x10017289
0x10017293
0x10017299
0x1001729b
0x1001729e
0x100172a4
0x100172aa
0x100172ad
0x100172b3
0x100172bb
0x100172c4
0x100172ca
0x100172d3
0x100172de
0x100172e2
0x100172e8
0x100172ed
0x100172f4
0x100172f9
0x100172f9
0x100172fd
0x10017300
0x10017306
0x1001730e
0x10017317
0x1001731d
0x10017326
0x10017331
0x10017335
0x1001733b
0x10017340
0x10017347
0x1001734c
0x1001734c
0x10017350
0x10017353
0x10017359
0x10017361
0x1001736a
0x10017370
0x10017379
0x10017384
0x10017388
0x1001738e
0x10017393
0x1001739a
0x1001739f
0x1001739f
0x100173a9
0x100173ae
0x100173b5
0x100173ba
0x100173ba
0x100173be
0x100173c1
0x100173c7
0x100174e1
0x100174e1
0x100174e4
0x100174ea
0x10017604
0x1001760a
0x1001760f
0x10017616
0x00000000
0x10017616
0x100174f0
0x100174f3
0x100174f9
0x10017501
0x1001750a
0x10017510
0x10017519
0x10017524
0x10017528
0x1001752e
0x10017533
0x1001753a
0x1001753f
0x1001753f
0x10017543
0x10017546
0x1001754c
0x10017554
0x1001755d
0x10017563
0x1001756c
0x10017577
0x1001757b
0x10017581
0x10017586
0x1001758d
0x10017592
0x10017592
0x10017596
0x10017599
0x1001759f
0x100175a7
0x100175b0
0x100175b6
0x100175bf
0x100175ca
0x100175ce
0x100175d4
0x100175d9
0x100175e0
0x100175e5
0x100175e5
0x100175ef
0x100175f4
0x100175fb
0x10017600
0x00000000
0x100173cd
0x100173cd
0x100173d0
0x100173d6
0x100173de
0x100173e7
0x100173ed
0x100173f6
0x10017401
0x10017405
0x1001740b
0x10017410
0x10017417
0x1001741c
0x1001741c
0x10017420
0x10017423
0x10017429
0x10017431
0x1001743a
0x10017440
0x10017449
0x10017454
0x10017458
0x1001745e
0x10017463
0x1001746a
0x1001746f
0x1001746f
0x10017473
0x10017476
0x1001747c
0x10017484
0x1001748d
0x10017493
0x1001749c
0x100174a7
0x100174ab
0x100174b1
0x100174b6
0x100174bd
0x100174c2
0x100174c2
0x100174cc
0x100174d1
0x100174d8
0x100174dd
0x00000000
0x100174dd
0x100173c7
0x1001724f
0x1001724f
0x10017252
0x10017260

APIs

mv_log.MAIN ref: 10017289
mv_freep.MAIN ref: 100172E8
mv_freep.MAIN ref: 100172F4
mv_expr_free.MAIN ref: 100172D9

Part of subcall function 10015280: mv_freep.MAIN ref: 10015588
Part of subcall function 10015280: mv_freep.MAIN ref: 10015594
Part of subcall function 10015280: mv_freep.MAIN ref: 100155DB
Part of subcall function 10015280: mv_freep.MAIN ref: 100155E7
Part of subcall function 10015280: mv_freep.MAIN ref: 100155F6
Part of subcall function 10015280: mv_freep.MAIN ref: 10015602
Part of subcall function 10015280: mv_freep.MAIN ref: 10015667
Part of subcall function 10015280: mv_freep.MAIN ref: 10015673
Part of subcall function 10015280: mv_freep.MAIN ref: 100156BA

mv_expr_free.MAIN ref: 100172CA

Part of subcall function 10015280: mv_freep.MAIN ref: 1001542C
Part of subcall function 10015280: mv_freep.MAIN ref: 10015438
Part of subcall function 10015280: mv_freep.MAIN ref: 10015447
Part of subcall function 10015280: mv_freep.MAIN ref: 10015453
Part of subcall function 10015280: mv_freep.MAIN ref: 1001549A
Part of subcall function 10015280: mv_freep.MAIN ref: 100154A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100154B5
Part of subcall function 10015280: mv_freep.MAIN ref: 100154C1
Part of subcall function 10015280: mv_freep.MAIN ref: 10015517
Part of subcall function 10015280: mv_freep.MAIN ref: 10015523

mv_expr_free.MAIN ref: 100172BB

Part of subcall function 10015280: mv_freep.MAIN ref: 100152FA
Part of subcall function 10015280: mv_freep.MAIN ref: 10015306
Part of subcall function 10015280: mv_freep.MAIN ref: 1001534D
Part of subcall function 10015280: mv_freep.MAIN ref: 10015359
Part of subcall function 10015280: mv_freep.MAIN ref: 10015368
Part of subcall function 10015280: mv_freep.MAIN ref: 10015374
Part of subcall function 10015280: mv_freep.MAIN ref: 100153D9
Part of subcall function 10015280: mv_freep.MAIN ref: 100153E5

mv_expr_free.MAIN ref: 1001730E
mv_expr_free.MAIN ref: 1001731D
mv_expr_free.MAIN ref: 1001732C
mv_freep.MAIN ref: 1001733B
mv_freep.MAIN ref: 10017347
mv_expr_free.MAIN ref: 10017361
mv_expr_free.MAIN ref: 10017370
mv_expr_free.MAIN ref: 1001737F
mv_freep.MAIN ref: 1001738E
mv_freep.MAIN ref: 1001739A
mv_freep.MAIN ref: 100173A9
mv_freep.MAIN ref: 100173B5
mv_expr_free.MAIN ref: 100173DE
mv_expr_free.MAIN ref: 100173ED
mv_expr_free.MAIN ref: 100173FC
mv_freep.MAIN ref: 1001740B
mv_freep.MAIN ref: 10017417
mv_expr_free.MAIN ref: 10017431
mv_expr_free.MAIN ref: 10017440
mv_expr_free.MAIN ref: 1001744F
mv_freep.MAIN ref: 1001745E
mv_freep.MAIN ref: 1001746A
mv_expr_free.MAIN ref: 10017484
mv_expr_free.MAIN ref: 10017493
mv_expr_free.MAIN ref: 100174A2
mv_freep.MAIN ref: 100174B1
mv_freep.MAIN ref: 100174BD
mv_freep.MAIN ref: 100174CC
mv_freep.MAIN ref: 100174D8
mv_expr_free.MAIN ref: 10017501
mv_expr_free.MAIN ref: 10017510
mv_expr_free.MAIN ref: 1001751F
mv_freep.MAIN ref: 1001752E
mv_freep.MAIN ref: 1001753A
mv_expr_free.MAIN ref: 10017554
mv_expr_free.MAIN ref: 10017563
mv_expr_free.MAIN ref: 10017572
mv_freep.MAIN ref: 10017581
mv_freep.MAIN ref: 1001758D
mv_expr_free.MAIN ref: 100175A7
mv_expr_free.MAIN ref: 100175B6
mv_expr_free.MAIN ref: 100175C5
mv_freep.MAIN ref: 100175D4
mv_freep.MAIN ref: 100175E0
mv_freep.MAIN ref: 100175EF
mv_freep.MAIN ref: 100175FB
mv_freep.MAIN ref: 1001760A
mv_freep.MAIN ref: 10017616

Strings

Invalid chars '%s' at the end of expression '%s', xrefs: 1001726C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_expr_free$mv_log
String ID: Invalid chars '%s' at the end of expression '%s'
API String ID: 75827668-1422635149
Opcode ID: 868f8d433a9d4ff7ca381ed327b9c79258ebc14a83ef6ba52564f0dccba394d0
Instruction ID: 47d116fedaedebc931fd27d2d79ea71f155cf045d5fda504e80a0eb2e0d77697
Opcode Fuzzy Hash: 868f8d433a9d4ff7ca381ed327b9c79258ebc14a83ef6ba52564f0dccba394d0
Instruction Fuzzy Hash: 86C146B95097519FC784EFA8D48581EBBE0FF88350F85586DF8C18B316E735E8848B92

Uniqueness

Uniqueness Score: -1.00%

Function 100177F0 Relevance: 75.3, APIs: 50, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_expr_parse.MAIN ref: 10017862

Part of subcall function 10017110: strlen.MSVCRT ref: 10017141
Part of subcall function 10017110: mv_malloc.MAIN ref: 1001714A

mv_expr_free.MAIN ref: 100178D7
mv_expr_free.MAIN ref: 100178E6
mv_expr_free.MAIN ref: 100178F5
mv_freep.MAIN ref: 10017904
mv_freep.MAIN ref: 1001790C
mv_expr_free.MAIN ref: 10017926
mv_expr_free.MAIN ref: 10017935
mv_expr_free.MAIN ref: 10017944
mv_freep.MAIN ref: 10017953
mv_freep.MAIN ref: 1001795B
mv_expr_free.MAIN ref: 10017975
mv_expr_free.MAIN ref: 10017984
mv_expr_free.MAIN ref: 10017993
mv_freep.MAIN ref: 100179A2
mv_freep.MAIN ref: 100179AA
mv_freep.MAIN ref: 100179B9
mv_freep.MAIN ref: 100179C5
mv_expr_free.MAIN ref: 100179EE
mv_freep.MAIN ref: 10017A1B
mv_freep.MAIN ref: 10017A23
mv_freep.MAIN ref: 10017A79
mv_freep.MAIN ref: 10017A81
mv_expr_free.MAIN ref: 10017A6A

Part of subcall function 10015280: mv_freep.MAIN ref: 100159C5
Part of subcall function 10015280: mv_freep.MAIN ref: 100159D1
Part of subcall function 10015280: mv_freep.MAIN ref: 100159E0
Part of subcall function 10015280: mv_freep.MAIN ref: 100159EC
Part of subcall function 10015280: mv_freep.MAIN ref: 100159FB
Part of subcall function 10015280: mv_freep.MAIN ref: 10015A07
Part of subcall function 10015280: mv_freep.MAIN ref: 10015A16
Part of subcall function 10015280: mv_freep.MAIN ref: 10015A22

mv_expr_free.MAIN ref: 10017A5B

Part of subcall function 10015280: mv_freep.MAIN ref: 1001584F
Part of subcall function 10015280: mv_freep.MAIN ref: 1001585B
Part of subcall function 10015280: mv_freep.MAIN ref: 100158A2
Part of subcall function 10015280: mv_freep.MAIN ref: 100158AE
Part of subcall function 10015280: mv_freep.MAIN ref: 100158BD
Part of subcall function 10015280: mv_freep.MAIN ref: 100158C9
Part of subcall function 10015280: mv_freep.MAIN ref: 1001591F
Part of subcall function 10015280: mv_freep.MAIN ref: 1001592B
Part of subcall function 10015280: mv_freep.MAIN ref: 10015972
Part of subcall function 10015280: mv_freep.MAIN ref: 1001597E

mv_expr_free.MAIN ref: 10017A4C

Part of subcall function 10015280: mv_freep.MAIN ref: 100156C6
Part of subcall function 10015280: mv_freep.MAIN ref: 100156D5
Part of subcall function 10015280: mv_freep.MAIN ref: 100156E1
Part of subcall function 10015280: mv_freep.MAIN ref: 100156F0
Part of subcall function 10015280: mv_freep.MAIN ref: 100156FC
Part of subcall function 10015280: mv_freep.MAIN ref: 10015770
Part of subcall function 10015280: mv_freep.MAIN ref: 1001577C
Part of subcall function 10015280: mv_freep.MAIN ref: 1001579A
Part of subcall function 10015280: mv_freep.MAIN ref: 100157A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100157FC
Part of subcall function 10015280: mv_freep.MAIN ref: 10015808

mv_freep.MAIN ref: 10017A90
mv_freep.MAIN ref: 10017A9C
mv_expr_free.MAIN ref: 10017AC5
mv_expr_free.MAIN ref: 10017AD4
mv_expr_free.MAIN ref: 10017AE3
mv_freep.MAIN ref: 10017AF2
mv_freep.MAIN ref: 10017AFA
mv_expr_free.MAIN ref: 10017B14
mv_expr_free.MAIN ref: 10017B23
mv_expr_free.MAIN ref: 10017B32
mv_freep.MAIN ref: 10017B41
mv_freep.MAIN ref: 10017B49
mv_expr_free.MAIN ref: 10017A32

Part of subcall function 10015280: mv_freep.MAIN ref: 10015588
Part of subcall function 10015280: mv_freep.MAIN ref: 10015594
Part of subcall function 10015280: mv_freep.MAIN ref: 100155DB
Part of subcall function 10015280: mv_freep.MAIN ref: 100155E7
Part of subcall function 10015280: mv_freep.MAIN ref: 100155F6
Part of subcall function 10015280: mv_freep.MAIN ref: 10015602
Part of subcall function 10015280: mv_freep.MAIN ref: 10015667
Part of subcall function 10015280: mv_freep.MAIN ref: 10015673
Part of subcall function 10015280: mv_freep.MAIN ref: 100156BA

mv_expr_free.MAIN ref: 10017A0C

Part of subcall function 10015280: mv_freep.MAIN ref: 1001542C
Part of subcall function 10015280: mv_freep.MAIN ref: 10015438
Part of subcall function 10015280: mv_freep.MAIN ref: 10015447
Part of subcall function 10015280: mv_freep.MAIN ref: 10015453
Part of subcall function 10015280: mv_freep.MAIN ref: 1001549A
Part of subcall function 10015280: mv_freep.MAIN ref: 100154A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100154B5
Part of subcall function 10015280: mv_freep.MAIN ref: 100154C1
Part of subcall function 10015280: mv_freep.MAIN ref: 10015517
Part of subcall function 10015280: mv_freep.MAIN ref: 10015523

mv_expr_free.MAIN ref: 100179FD

Part of subcall function 10015280: mv_freep.MAIN ref: 100152FA
Part of subcall function 10015280: mv_freep.MAIN ref: 10015306
Part of subcall function 10015280: mv_freep.MAIN ref: 1001534D
Part of subcall function 10015280: mv_freep.MAIN ref: 10015359
Part of subcall function 10015280: mv_freep.MAIN ref: 10015368
Part of subcall function 10015280: mv_freep.MAIN ref: 10015374
Part of subcall function 10015280: mv_freep.MAIN ref: 100153D9
Part of subcall function 10015280: mv_freep.MAIN ref: 100153E5

mv_expr_free.MAIN ref: 10017B63
mv_expr_free.MAIN ref: 10017B72
mv_expr_free.MAIN ref: 10017B81
mv_freep.MAIN ref: 10017B90
mv_freep.MAIN ref: 10017B98
mv_freep.MAIN ref: 10017BA7
mv_freep.MAIN ref: 10017BB3
mv_freep.MAIN ref: 10017BC2
mv_freep.MAIN ref: 10017BCE

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_expr_free$mv_expr_parsemv_mallocstrlen
String ID:
API String ID: 1389959791-0
Opcode ID: 8ed2cf0b96ea738395e10688aaa6a7ba80d46e84586e5b5581eb5791b7552261
Instruction ID: 676c052f7482def6436772c87c2f32b108e761ae451283d38321aee012e0f911
Opcode Fuzzy Hash: 8ed2cf0b96ea738395e10688aaa6a7ba80d46e84586e5b5581eb5791b7552261
Instruction Fuzzy Hash: 1BD173B9A187418FC750EF68D48191ABBF0FF89214F45496DE9D48B315E736E8848F82

Uniqueness

Uniqueness Score: -1.00%

Function 1004E110 Relevance: 57.9, APIs: 15, Strings: 18, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E1004E110(intOrPtr* __eax, void* __ecx, char* __edx) {
				char _v1052;
				char* _v1056;
				intOrPtr _v1072;
				char* _v1076;
				char* _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t52;
				signed int _t57;
				char* _t59;
				char* _t64;
				intOrPtr* _t92;
				char* _t102;
				char* _t104;
				void* _t108;
				signed int _t109;
				void* _t111;
				char* _t112;
				void* _t113;
				intOrPtr* _t114;

				_t111 = __ecx;
				_t92 = __eax;
				_t114 = _t113 - 0x42c;
				_t52 = 0;
				_v1056 = __edx;
				do {
					 *((intOrPtr*)(_t114 + _t52 + 0x20)) = 0;
					 *((intOrPtr*)(_t114 + _t52 + 0x24)) = 0;
					_t52 = _t52 + 8;
				} while (_t52 < 0x400);
				_v1076 = 1;
				_t112 =  &_v1052;
				_v1080 = 0;
				 *_t114 = _t112;
				E10008880(__eax, _t108, __ecx, _t112);
				_v1080 = "%s - type: ";
				 *_t114 = _t112;
				_v1076 =  *_t92;
				E100089C0();
				_t57 =  *(_t92 + 8);
				if(_t57 > 8) {
					_t59 =  !=  ? "unknown" : "any";
				} else {
					switch( *((intOrPtr*)(_t57 * 4 +  &M100BCC2C))) {
						case 0:
							__eax = "fft_float";
							goto L5;
						case 1:
							_t59 = "mdct_float";
							goto L5;
						case 2:
							__eax = "fft_double";
							goto L5;
						case 3:
							__eax = "mdct_double";
							goto L5;
						case 4:
							__eax = "fft_int32";
							goto L5;
						case 5:
							__eax = "mdct_int32";
							goto L5;
						case 6:
							__eax = "rdft_float";
							goto L5;
						case 7:
							__eax = "rdft_double";
							goto L5;
						case 8:
							__eax = "rdft_int32";
							goto L5;
					}
				}
				L5:
				_v1076 = _t59;
				_v1080 = "%s";
				 *_t114 = _t112;
				E100089C0();
				_v1080 = ", len: ";
				 *_t114 = _t112;
				E100089C0();
				_t102 =  *((intOrPtr*)(_t92 + 0x28));
				_t64 =  *((intOrPtr*)(_t92 + 0x2c));
				if(_t102 != _t64) {
					_v1076 = _t102;
					_v1080 = "[%i, ";
					 *_t114 = _t112;
					E100089C0();
					_t64 =  *((intOrPtr*)(_t92 + 0x2c));
				}
				if(_t64 == 0xffffffff) {
					 *_t114 = _t112;
					_v1080 = 0x100bcc00;
					E100089C0();
				} else {
					_v1076 = _t64;
					_v1080 = 0x100bcc04;
					 *_t114 = _t112;
					E100089C0();
				}
				_v1080 = "%s, factors: [";
				 *_t114 = _t112;
				_t69 =  !=  ? 0x100bcb72 : 0x100bcb03;
				_t109 = 0;
				_v1076 =  !=  ? 0x100bcb72 : 0x100bcb03;
				E100089C0();
				_t104 =  *((intOrPtr*)(_t92 + 0x18));
				if(_t104 == 0xffffffff) {
					 *_t114 = _t112;
					_t109 = 1;
					_v1080 = "any";
					E100089C0();
					goto L13;
				} else {
					L10:
					if(_t104 != 0) {
						_v1076 = _t104;
						_v1080 = 0x100bcc04;
						 *_t114 = _t112;
						E100089C0();
						L12:
						_t109 = _t109 + 1;
						if(_t109 != 4) {
							L13:
							if( *((intOrPtr*)(_t92 + 0x18 + _t109 * 4)) != 0) {
								 *_t114 = _t112;
								_v1080 = 0x100bcb00;
								E100089C0();
								_t104 =  *((intOrPtr*)(_t92 + 0x18 + _t109 * 4));
								if(_t104 != 0xffffffff) {
									goto L10;
								} else {
									 *_t114 = _t112;
									_v1080 = "any";
									E100089C0();
									goto L12;
								}
							}
						}
					}
				}
				 *_t114 = _t112;
				_v1080 = "], ";
				E100089C0();
				E1004DA90(_t112,  *((intOrPtr*)(_t92 + 0x14)),  *((intOrPtr*)(_t92 + 0x10)));
				if(_t111 != 0) {
					 *_t114 = _t112;
					_v1080 = ", prio: %i";
					_v1076 = _v1056;
					E100089C0();
				}
				 *_t114 = 0;
				_v1080 = 0x28;
				_v1072 = _v1052;
				_v1076 = "%s\n";
				return E10023A40();
			}

0x1004e113
0x1004e116
0x1004e118
0x1004e11e
0x1004e120
0x1004e126
0x1004e126
0x1004e12a
0x1004e12e
0x1004e131
0x1004e13f
0x1004e143
0x1004e147
0x1004e14b
0x1004e14e
0x1004e15a
0x1004e15e
0x1004e161
0x1004e165
0x1004e16a
0x1004e170
0x1004e373
0x1004e176
0x1004e176
0x00000000
0x1004e320
0x00000000
0x00000000
0x1004e180
0x00000000
0x00000000
0x1004e2f0
0x00000000
0x00000000
0x1004e2e0
0x00000000
0x00000000
0x1004e2d0
0x00000000
0x00000000
0x1004e2c0
0x00000000
0x00000000
0x1004e310
0x00000000
0x00000000
0x1004e300
0x00000000
0x00000000
0x1004e2b0
0x00000000
0x00000000
0x1004e176
0x1004e190
0x1004e190
0x1004e199
0x1004e19d
0x1004e1a0
0x1004e1aa
0x1004e1ae
0x1004e1b1
0x1004e1b6
0x1004e1b9
0x1004e1be
0x1004e1c0
0x1004e1c9
0x1004e1cd
0x1004e1d0
0x1004e1d5
0x1004e1d5
0x1004e1db
0x1004e380
0x1004e388
0x1004e38c
0x1004e1e1
0x1004e1e1
0x1004e1ea
0x1004e1ee
0x1004e1f1
0x1004e1f1
0x1004e20b
0x1004e20f
0x1004e212
0x1004e215
0x1004e217
0x1004e21b
0x1004e220
0x1004e226
0x1004e3c0
0x1004e3c8
0x1004e3cd
0x1004e3d1
0x00000000
0x1004e22c
0x1004e22c
0x1004e22e
0x1004e230
0x1004e239
0x1004e23d
0x1004e240
0x1004e245
0x1004e245
0x1004e249
0x1004e24b
0x1004e251
0x1004e330
0x1004e338
0x1004e33c
0x1004e341
0x1004e348
0x00000000
0x1004e34e
0x1004e34e
0x1004e356
0x1004e35a
0x00000000
0x1004e35a
0x1004e348
0x1004e251
0x1004e249
0x1004e22e
0x1004e257
0x1004e25f
0x1004e263
0x1004e272
0x1004e279
0x1004e3a0
0x1004e3ac
0x1004e3b0
0x1004e3b4
0x1004e3b4
0x1004e27f
0x1004e28f
0x1004e293
0x1004e29c
0x1004e2af

APIs

mv_bprint_init.MAIN ref: 1004E14E
mv_bprintf.MAIN ref: 1004E165

Strings

any, xrefs: 1004E351, 1004E36E, 1004E3C3
%s, factors: [, xrefs: 1004E1FE
mdct_double, xrefs: 1004E2E0
fft_float, xrefs: 1004E320
%s - type: , xrefs: 1004E155
], , xrefs: 1004E25A
, prio: %i, xrefs: 1004E3A7
mdct_float, xrefs: 1004E180
, len: , xrefs: 1004E1A5
fft_double, xrefs: 1004E2F0
rdft_int32, xrefs: 1004E2B0
rdft_double, xrefs: 1004E300
%s, xrefs: 1004E297
unknown, xrefs: 1004E369
mdct_int32, xrefs: 1004E2C0
[%i, , xrefs: 1004E1C4
rdft_float, xrefs: 1004E310
fft_int32, xrefs: 1004E2D0

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_initmv_bprintf
String ID: %s$%s - type: $%s, factors: [$, len: $, prio: %i$[%i, $], $any$fft_double$fft_float$fft_int32$mdct_double$mdct_float$mdct_int32$rdft_double$rdft_float$rdft_int32$unknown
API String ID: 3566169034-155954179
Opcode ID: 88f9e843cdda70b065da0d6e9f33fb5096cf4e39f39d2173ac39fcec4dc56677
Instruction ID: a933a466284158a9cdbf5e2fa88c9023184ecaf356d014cc5bc8696811956cc8
Opcode Fuzzy Hash: 88f9e843cdda70b065da0d6e9f33fb5096cf4e39f39d2173ac39fcec4dc56677
Instruction Fuzzy Hash: 5051F7B8A08784CBD740EF29858191EBBE1FB84350F65892EE8C9CB355DB38DC409B46

Uniqueness

Uniqueness Score: -1.00%

Function 10029950 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_log.MAIN ref: 10029459
mv_log.MAIN ref: 10029593
mv_log.MAIN ref: 100295B8
mv_log.MAIN ref: 1002967C
mv_log.MAIN ref: 100296AB
mv_log.MAIN ref: 1002964D

Part of subcall function 10028940: mv_log.MAIN ref: 10028A2C

mv_freep.MAIN ref: 10029721
mv_freep.MAIN ref: 1002972D
mv_log.MAIN ref: 1002977B
mv_log.MAIN ref: 10029985

Strings

%-15s , xrefs: 100292D4
%-12s , xrefs: 10029440
"%s", xrefs: 100297AF
%lld, xrefs: 10029876
%d/%d, xrefs: 10029A8B
(default , xrefs: 10029762
(from , xrefs: 10029638
%-12lld , xrefs: 10029961
%c%c%c%c%c%c%c%c%c%c%c, xrefs: 1002957E
%s, xrefs: 100295A3
to , xrefs: 10029667

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_freep
String ID: %-15s $ %s$ (default $ (from $ to $"%s"$%-12lld $%-12s $%c%c%c%c%c%c%c%c%c%c%c$%d/%d$%lld
API String ID: 3216983768-538076109
Opcode ID: af5e232d3e8434cd70fd890344711586ed06383701569213a989fbf4a3101a93
Instruction ID: 6669a645e77abe44fb88f8918c652bef149803a1577f2af9334f6d103ff6ece3
Opcode Fuzzy Hash: af5e232d3e8434cd70fd890344711586ed06383701569213a989fbf4a3101a93
Instruction Fuzzy Hash: 6102E3B4A187418FC714CF28D48065EBBE1FF89790F95C92EF8A98B391D774E8458B42

Uniqueness

Uniqueness Score: -1.00%

Function 10009730 Relevance: 51.1, APIs: 23, Strings: 6, Instructions: 372
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E10009730(int _a4, int _a8, unsigned int _a12, void** _a16, void* _a20) {
				char _v29;
				signed int _v32;
				int _v36;
				char _v37;
				void** _v40;
				signed int _v44;
				char** _v52;
				int _v56;
				int __ebx;
				int __edi;
				signed int __esi;
				int __ebp;
				signed int _t114;
				void** _t115;
				int _t116;
				int _t117;
				void* _t118;
				void* _t119;
				int _t120;
				void* _t121;
				signed char _t123;
				void* _t124;
				signed char* _t129;
				int _t130;
				void* _t133;
				unsigned int _t135;
				int _t136;
				signed int _t137;
				char _t146;
				void* _t150;
				int _t157;
				signed int _t158;
				void* _t163;
				void* _t164;
				void* _t167;
				void** _t170;
				int _t172;
				int _t173;
				int _t174;
				void* _t175;
				void** _t178;
				void*** _t179;
				void** _t180;

				_t179 =  &_v44;
				_t170 = _a4;
				_t129 = _a8;
				_v44 = _a12;
				_t112 = _a16;
				if(_a16 == 2) {
					L1();
					_t114 =  *_t129 & 0x000000ff;
					__eflags = _t114;
					if(_t114 != 0) {
						while(1) {
							L56:
							__eflags = _t114 - 0x27;
							if(_t114 == 0x27) {
								break;
							}
							_t129 =  &(_t129[1]);
							L1();
							_t114 =  *_t129 & 0x000000ff;
							__eflags = _t114;
							if(_t114 != 0) {
								continue;
							}
							goto L58;
						}
						 *_t179 = _t170;
						_t129 =  &(_t129[1]);
						_v56 = 0x100ac503;
						E100089C0();
						_t114 =  *_t129 & 0x000000ff;
						__eflags = _t114;
						if(_t114 != 0) {
							goto L56;
						} else {
						}
					}
					L58:
					_t179 =  &(_t179[0xb]);
					_t112 = _t170;
					_pop(_t129);
					_pop(_t170);
					_pop(_t161);
					_pop(_t177);
					_t178 = _t112;
					_push(_t170);
					_push(_t129);
					_t115 =  &(_t112[4]);
					_t180 = _t179 - 0x2c;
					_v29 = 0x27;
					_t130 =  *(_t115 - 8);
					_v40 = _t115;
					while(1) {
						_t116 = _a4;
						_t144 =  <=  ? _t116 : _t130;
						_t172 = _t130 - ( <=  ? _t116 : _t130);
						if(_t172 > 1) {
							break;
						}
						_t135 = _a12;
						if(_t116 >= _t130 || _t135 == _t130) {
							L22:
							__eflags = _t172;
							if(_t172 != 0) {
								_t172 = 1;
								break;
							}
						} else {
							_t154 =  >  ? 1 : 0xfffffffe - _t116;
							_t17 = _t116 + 1; // 0xffffffff
							_t121 = ( >  ? 1 : 0xfffffffe - _t116) + _t17;
							if(_t135 >> 1 >= _t130) {
								_t130 = _t130 + _t130;
								__eflags = _t130;
							} else {
								_t130 = _t135;
							}
							if(_t130 < _t121) {
								_t125 =  <=  ? _t135 : _t121;
								_t130 =  <=  ? _t135 : _t121;
							}
							_t163 =  *_t178;
							_v56 = _t130;
							if(_t163 == _v40) {
								 *_t180 = 0;
								_t123 = E10026280();
								__eflags = _t123;
								if(_t123 == 0) {
									goto L21;
								} else {
									goto L15;
								}
							} else {
								 *_t180 = _t163;
								_t123 = E10026280();
								if(_t123 == 0) {
									L21:
									_t116 = _a4;
									goto L22;
								} else {
									if(_t163 == 0) {
										L15:
										_t157 = _a4;
										_t164 = _t123;
										_t175 =  *_t178;
										_t136 = _t157 + 1;
										_v36 = _t175;
										__eflags = _t136 - 8;
										if(_t136 >= 8) {
											__eflags = _t123 & 0x00000001;
											if((_t123 & 0x00000001) != 0) {
												_t137 =  *_t175 & 0x000000ff;
												_t35 = _t123 + 1; // 0x1
												_t164 = _t35;
												_t175 = _t175 + 1;
												 *_t123 = _t137;
												_t136 = _t157;
											}
											__eflags = _t164 & 0x00000002;
											if((_t164 & 0x00000002) != 0) {
												_t158 =  *_t175 & 0x0000ffff;
												_t164 = _t164 + 2;
												_t175 = _t175 + 2;
												_t136 = _t136 - 2;
												 *(_t164 - 2) = _t158;
											}
											__eflags = _t164 & 0x00000004;
											if((_t164 & 0x00000004) == 0) {
												goto L16;
											} else {
												_t167 = _t164 + 4;
												 *(_t167 - 4) =  *_t175;
												_t124 = memcpy(_t167, _t175 + 4, _t136 - 4);
												_t180 =  &(_t180[3]);
												goto L8;
											}
										} else {
											L16:
											_t124 = memcpy(_t164, _t175, _t136);
											_t180 =  &(_t180[3]);
											goto L8;
										}
										goto L23;
									}
									L8:
									 *_t178 = _t124;
									_a8 = _t130;
									continue;
								}
							}
						}
						L23:
						__eflags = 0xfffffffa;
						_t149 =  >  ? 1 : 0xfffffffa - _t116;
						_t150 = ( >  ? 1 : 0xfffffffa - _t116) + _t116;
						_t117 = _a8;
						_a4 = 0xfffffffa;
						__eflags = _t117;
						if(_t117 != 0) {
							_t118 = _t117 - 1;
							__eflags = _t118 - 0xfffffffa;
							_t119 =  >  ? _t150 : _t118;
							 *((char*)( *_t178 + _t119)) = 0;
							return _t119;
						}
						return _t117;
						goto L122;
					}
					_t173 = _t172 - 1;
					__eflags = _t173;
					_t174 =  >  ? 1 : _t173;
					_t146 = _v29;
					_t133 =  *_t178 + _t116;
					__eflags = _t174;
					if(_t174 != 0) {
						_t120 = 0;
						__eflags = 0;
						do {
							 *((char*)(_t133 + _t120)) = _t146;
							_t120 = _t120 + 1;
							__eflags = _t120 - _t174;
						} while (_t120 < _t174);
						_t116 = _a4;
					}
					goto L23;
				} else {
					__eflags = __eax - 3;
					if(__eax != 3) {
						__eax =  *__ebx;
						__eflags = __al;
						if(__al != 0) {
							__eflags = __cl & 0x00000002;
							if((__cl & 0x00000002) == 0) {
								_v37 = 1;
								__ebp = _v44;
								__edi = __ebx;
								__eflags = _v44;
								if(_v44 == 0) {
									_v36 = __ecx;
									while(1) {
										 *__esp = " \n\t\r";
										__ebp = __al;
										_v56 = __ebp;
										__eax = strchr(??, ??);
										_v56 = __ebp;
										 *__esp = "\'\\";
										_v44 = __eax;
										__eax = strchr(??, ??);
										__eflags = __eax;
										if(__eax == 0) {
											goto L118;
										}
										L113:
										__edx = 0x5c;
										__eax = __esi;
										L1();
										L114:
										__edx =  *__edi;
										__eax = __esi;
										__edi = __edi + 1;
										L1();
										__eax =  *__edi & 0x000000ff;
										__eflags = __al;
										if(__al != 0) {
											__eflags = __ebx - __edi;
											if(__ebx == __edi) {
												_v37 = 1;
											} else {
												__eflags =  *(__edi + 1);
												_v37 =  *(__edi + 1) == 0;
											}
											continue;
										}
										goto L53;
										L118:
										__edx = _v44;
										__eflags = _v44;
										if(_v44 != 0) {
											__eflags = _v36 & 0x00000001;
											if((_v36 & 0x00000001) != 0) {
												goto L113;
											} else {
												__eflags = _v37;
												if(_v37 != 0) {
													goto L113;
												} else {
												}
											}
										}
										goto L114;
									}
								} else {
									_v32 = __ecx;
									while(1) {
										 *__esp = " \n\t\r";
										__ebp = __al;
										_v56 = __ebp;
										__eax = strchr(??, ??);
										_v56 = __ebp;
										_v36 = __eax;
										__eax = _v44;
										 *__esp = _v44;
										__eax = strchr(??, ??);
										__eflags = __eax;
										if(__eax == 0) {
											goto L97;
										}
										L70:
										__edx = 0x5c;
										__eax = __esi;
										L1();
										L71:
										__edx =  *__edi;
										__eax = __esi;
										__edi = __edi + 1;
										L1();
										__eax =  *__edi & 0x000000ff;
										__eflags = __al;
										if(__al != 0) {
											__eflags = __ebx - __edi;
											if(__ebx == __edi) {
												_v37 = 1;
											} else {
												__eflags =  *(__edi + 1);
												_v37 =  *(__edi + 1) == 0;
											}
											continue;
										}
										goto L53;
										L97:
										__eax = strchr("\'\\", __ebp);
										__eflags = __eax;
										if(__eax != 0) {
											goto L70;
										} else {
											__eax = _v36;
											__eflags = _v36;
											if(_v36 != 0) {
												__eflags = _v32 & 0x00000001;
												if((_v32 & 0x00000001) != 0) {
													goto L70;
												} else {
													__eflags = _v37;
													if(_v37 != 0) {
														goto L70;
													} else {
													}
												}
											}
										}
										goto L71;
									}
								}
							} else {
								__edx = _v44;
								__eflags = _v44;
								if(_v44 == 0) {
									while(1) {
										__edx =  *__ebx;
										__eax = __esi;
										__ebx = __ebx + 1;
										L1();
										__eflags =  *__ebx;
										if( *__ebx == 0) {
											goto L53;
										}
										__edx =  *__ebx;
										__eax = __esi;
										__ebx = __ebx + 1;
										L1();
										__eflags =  *__ebx;
										if( *__ebx == 0) {
											return __eax;
										}
									}
								} else {
									do {
										_v56 = __eax;
										__eax = _v44;
										 *__esp = _v44;
										__eax = strchr(??, ??);
										__eflags = __eax;
										if(__eax != 0) {
											__edx = 0x5c;
											__eax = __esi;
											L1();
										}
										__edx =  *__ebx;
										__eax = __esi;
										__ebx = __ebx + 1;
										L1();
										__eax =  *__ebx;
										__eflags = __al;
									} while (__al != 0);
								}
							}
						}
					} else {
						__eax =  *__ebx & 0x000000ff;
						__eflags = __al;
						if(__al != 0) {
							__edx = __ecx;
							__edx = __ecx & 0x00000008;
							__eflags = __cl & 0x00000004;
							if((__cl & 0x00000004) != 0) {
								__eflags = __edx;
								if(__edx == 0) {
									goto L85;
								} else {
									do {
										__dl = __al;
										__dl = __al - 0x22;
										__eflags = __dl - 0x1c;
										if(__dl > 0x1c) {
											L89:
											__edx = __al;
											__eax = __esi;
											L1();
											goto L90;
										}
										__edx = __dl & 0x000000ff;
										switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M100AC530))) {
											case 0:
												 *__esp = __esi;
												__eax = "&quot;";
												_v52 = "&quot;";
												__eax = 0x100ac500;
												_v56 = 0x100ac500;
												__eax = E100089C0();
												goto L90;
											case 1:
												goto L89;
											case 2:
												 *__esp = __esi;
												__eax = 0x100ac508;
												_v52 = 0x100ac508;
												__eax = 0x100ac500;
												_v56 = 0x100ac500;
												__eax = E100089C0();
												goto L90;
											case 3:
												 *__esp = __esi;
												__eax = "&apos;";
												_v52 = "&apos;";
												__eax = 0x100ac500;
												_v56 = 0x100ac500;
												__eax = E100089C0();
												goto L90;
											case 4:
												 *__esp = __esi;
												__edi = 0x100ac50e;
												__ebp = 0x100ac500;
												_v52 = 0x100ac50e;
												_v56 = 0x100ac500;
												__eax = E100089C0();
												goto L90;
											case 5:
												 *__esp = __esi;
												__edx = 0x100ac513;
												__ecx = 0x100ac500;
												_v52 = 0x100ac513;
												_v56 = 0x100ac500;
												__eax = E100089C0();
												goto L90;
										}
										L90:
										__eax =  *(__ebx + 1) & 0x000000ff;
										__ebx = __ebx + 1;
										__eflags = __al;
									} while (__al != 0);
									return __eax;
								}
								do {
									goto L85;
									L84:
									__eax =  *(__ebx + 1) & 0x000000ff;
									__ebx = __ebx + 1;
									__eflags = __al;
								} while (__al != 0);
								goto L53;
								L85:
								__eflags = __al - 0x3c;
								if(__eflags == 0) {
									 *__esp = __esi;
									__eax = 0x100ac50e;
									__edx = 0x100ac500;
									_v52 = 0x100ac50e;
									_v56 = 0x100ac500;
									__eax = E100089C0();
								} else {
									if(__eflags <= 0) {
										__eflags = __al - 0x26;
										if(__al == 0x26) {
											 *__esp = __esi;
											__eax = 0x100ac508;
											_v52 = 0x100ac508;
											__eax = 0x100ac500;
											_v56 = 0x100ac500;
											__eax = E100089C0();
										} else {
											__eflags = __al - 0x27;
											if(__al != 0x27) {
												goto L103;
											} else {
												 *__esp = __esi;
												__ebp = "&apos;";
												__eax = 0x100ac500;
												_v52 = "&apos;";
												_v56 = 0x100ac500;
												__eax = E100089C0();
											}
										}
									} else {
										__eflags = __al - 0x3e;
										if(__al != 0x3e) {
											L103:
											__edx = __al;
											__eax = __esi;
											L1();
										} else {
											 *__esp = __esi;
											__ecx = 0x100ac513;
											__edi = 0x100ac500;
											_v52 = 0x100ac513;
											_v56 = 0x100ac500;
											__eax = E100089C0();
										}
									}
								}
								goto L84;
							} else {
								__eflags = __edx;
								if(__edx == 0) {
									do {
										__eflags = __al - 0x3c;
										if(__al == 0x3c) {
											 *__esp = __esi;
											__ebp = 0x100ac50e;
											__eax = 0x100ac500;
											_v52 = 0x100ac50e;
											_v56 = 0x100ac500;
											__eax = E100089C0();
										} else {
											__eflags = __al - 0x3e;
											if(__al != 0x3e) {
												__eflags = __al - 0x26;
												if(__al == 0x26) {
													 *__esp = __esi;
													__eax = 0x100ac508;
													_v52 = 0x100ac508;
													__eax = 0x100ac500;
													_v56 = 0x100ac500;
													__eax = E100089C0();
												} else {
													__edx = __al;
													__eax = __esi;
													L1();
												}
											} else {
												 *__esp = __esi;
												__ecx = 0x100ac513;
												__edi = 0x100ac500;
												_v52 = 0x100ac513;
												_v56 = 0x100ac500;
												__eax = E100089C0();
											}
										}
										__eax =  *(__ebx + 1) & 0x000000ff;
										__ebx = __ebx + 1;
										__eflags = __al;
									} while (__al != 0);
								} else {
									do {
										__eflags = __al - 0x3c;
										if(__eflags == 0) {
											 *__esp = __esi;
											__edx = 0x100ac50e;
											__ecx = 0x100ac500;
											_v52 = 0x100ac50e;
											_v56 = 0x100ac500;
											__eax = E100089C0();
										} else {
											if(__eflags <= 0) {
												__eflags = __al - 0x22;
												if(__al == 0x22) {
													 *__esp = __esi;
													__eax = "&quot;";
													_v52 = "&quot;";
													__eax = 0x100ac500;
													_v56 = 0x100ac500;
													__eax = E100089C0();
												} else {
													__eflags = __al - 0x26;
													if(__al != 0x26) {
														goto L102;
													} else {
														 *__esp = __esi;
														__eax = 0x100ac508;
														_v52 = 0x100ac508;
														__eax = 0x100ac500;
														_v56 = 0x100ac500;
														__eax = E100089C0();
													}
												}
											} else {
												__eflags = __al - 0x3e;
												if(__al != 0x3e) {
													L102:
													__edx = __al;
													__eax = __esi;
													L1();
												} else {
													 *__esp = __esi;
													__edi = 0x100ac513;
													__ebp = 0x100ac500;
													_v52 = 0x100ac513;
													_v56 = 0x100ac500;
													__eax = E100089C0();
												}
											}
										}
										goto L41;
										L41:
										__eax =  *(__ebx + 1) & 0x000000ff;
										__ebx = __ebx + 1;
										__eflags = __al;
									} while (__al != 0);
								}
							}
						}
					}
					L53:
					return __eax;
				}
				L122:
			}

0x10009734
0x1000973b
0x1000973f
0x10009747
0x1000974b
0x10009752
0x10009877
0x1000987c
0x1000987f
0x10009881
0x10009890
0x10009890
0x10009890
0x10009892
0x00000000
0x00000000
0x10009897
0x1000989a
0x1000989f
0x100098a2
0x100098a4
0x00000000
0x00000000
0x00000000
0x100098a4
0x100098c0
0x100098c8
0x100098c9
0x100098cd
0x100098d2
0x100098d5
0x100098d7
0x00000000
0x00000000
0x100098d9
0x100098d7
0x100098a6
0x100098a6
0x100098a9
0x100098ab
0x100098b1
0x100098b2
0x100098b3
0x100086f1
0x100086f4
0x100086f5
0x100086f6
0x100086f9
0x100086fc
0x10008700
0x10008703
0x10008746
0x10008746
0x1000874f
0x10008752
0x10008757
0x00000000
0x00000000
0x1000875f
0x10008762
0x100087f4
0x100087f4
0x100087f6
0x1000882b
0x00000000
0x1000882b
0x10008770
0x1000877f
0x10008782
0x10008782
0x1000878c
0x10008710
0x10008710
0x1000878e
0x1000878e
0x1000878e
0x10008714
0x10008718
0x1000871b
0x1000871b
0x1000871d
0x10008720
0x1000872a
0x10008798
0x1000879f
0x100087a4
0x100087a6
0x00000000
0x00000000
0x00000000
0x00000000
0x1000872c
0x1000872c
0x1000872f
0x10008736
0x100087f1
0x100087f1
0x00000000
0x1000873c
0x1000873e
0x100087a8
0x100087a8
0x100087ab
0x100087ad
0x100087b0
0x100087b3
0x100087b7
0x100087ba
0x100087c0
0x100087c2
0x10008859
0x1000885c
0x1000885c
0x1000885f
0x10008860
0x10008862
0x10008862
0x100087c8
0x100087ce
0x10008869
0x1000886c
0x1000886f
0x10008872
0x10008875
0x10008875
0x100087d4
0x100087da
0x00000000
0x100087dc
0x100087de
0x100087e7
0x100087ea
0x100087ea
0x00000000
0x100087ea
0x100087bc
0x100087bc
0x100087bc
0x100087bc
0x00000000
0x100087bc
0x00000000
0x100087ba
0x10008740
0x10008740
0x10008743
0x00000000
0x10008743
0x10008736
0x1000872a
0x100087f8
0x10008804
0x10008807
0x1000880a
0x1000880c
0x1000880f
0x10008812
0x10008814
0x10008816
0x10008817
0x10008819
0x1000881f
0x00000000
0x1000881f
0x1000882a
0x00000000
0x1000882a
0x10008833
0x10008839
0x1000883c
0x1000883f
0x10008844
0x10008846
0x10008848
0x1000884a
0x1000884a
0x1000884c
0x1000884c
0x1000884f
0x10008850
0x10008850
0x10008854
0x10008854
0x00000000
0x10009758
0x10009758
0x1000975b
0x10009808
0x1000980b
0x1000980d
0x1000980f
0x10009812
0x10009930
0x10009935
0x10009939
0x1000993b
0x1000993d
0x10009c70
0x10009c80
0x10009c80
0x10009c87
0x10009c8a
0x10009c8e
0x10009c93
0x10009c97
0x10009c9e
0x10009ca2
0x10009ca7
0x10009ca9
0x00000000
0x00000000
0x10009cab
0x10009cab
0x10009cb0
0x10009cb2
0x10009cb7
0x10009cb7
0x10009cba
0x10009cbc
0x10009cbd
0x10009cc2
0x10009cc5
0x10009cc7
0x10009ccd
0x10009ccf
0x10009ce0
0x10009cd1
0x10009cd1
0x10009cd5
0x10009cd5
0x00000000
0x10009ccf
0x00000000
0x10009cf0
0x10009cf0
0x10009cf4
0x10009cf6
0x10009cf8
0x10009cfd
0x00000000
0x10009cff
0x10009cff
0x10009d04
0x00000000
0x00000000
0x10009d06
0x10009d04
0x10009cfd
0x00000000
0x10009cf6
0x10009943
0x10009943
0x10009950
0x10009950
0x10009957
0x1000995a
0x1000995e
0x10009963
0x10009967
0x1000996b
0x1000996f
0x10009972
0x10009977
0x10009979
0x00000000
0x00000000
0x1000997f
0x1000997f
0x10009984
0x10009986
0x1000998b
0x1000998b
0x1000998e
0x10009990
0x10009991
0x10009996
0x10009999
0x1000999b
0x100099a1
0x100099a3
0x10009ba0
0x100099a9
0x100099a9
0x100099ad
0x100099ad
0x00000000
0x100099a3
0x00000000
0x10009b40
0x10009b4b
0x10009b50
0x10009b52
0x00000000
0x10009b58
0x10009b58
0x10009b5c
0x10009b5e
0x10009b64
0x10009b69
0x00000000
0x10009b6f
0x10009b6f
0x10009b74
0x00000000
0x00000000
0x10009b7a
0x10009b74
0x10009b69
0x10009b5e
0x00000000
0x10009b52
0x10009950
0x10009818
0x10009818
0x1000981c
0x1000981e
0x100099b8
0x100099b8
0x100099bb
0x100099bd
0x100099be
0x100099c3
0x100099c6
0x00000000
0x00000000
0x100099cc
0x100099cf
0x100099d1
0x100099d2
0x100099d7
0x100099da
0x00000000
0x00000000
0x100099da
0x00000000
0x10009830
0x10009830
0x10009834
0x10009838
0x1000983b
0x10009840
0x10009842
0x10009844
0x10009849
0x1000984b
0x1000984b
0x10009850
0x10009853
0x10009855
0x10009856
0x1000985b
0x1000985e
0x1000985e
0x10009830
0x1000981e
0x10009812
0x10009761
0x10009761
0x10009764
0x10009766
0x1000976c
0x1000976e
0x10009771
0x10009774
0x100099e8
0x100099ea
0x00000000
0x100099f0
0x100099f0
0x100099f0
0x100099f2
0x100099f5
0x100099f8
0x10009a88
0x10009a88
0x10009a8b
0x10009a8d
0x00000000
0x10009a8d
0x100099fe
0x10009a01
0x00000000
0x10009b17
0x10009b1a
0x10009b1f
0x10009b23
0x10009b28
0x10009b2c
0x00000000
0x00000000
0x00000000
0x00000000
0x10009aa4
0x10009aa7
0x10009aac
0x10009ab0
0x10009ab5
0x10009ab9
0x00000000
0x00000000
0x10009af8
0x10009afb
0x10009b00
0x10009b04
0x10009b09
0x10009b0d
0x00000000
0x00000000
0x10009adc
0x10009adf
0x10009ae4
0x10009ae9
0x10009aed
0x10009af1
0x00000000
0x00000000
0x10009ac0
0x10009ac3
0x10009ac8
0x10009acd
0x10009ad1
0x10009ad5
0x00000000
0x00000000
0x10009a92
0x10009a92
0x10009a96
0x10009a97
0x10009a97
0x00000000
0x100099f0
0x10009a4d
0x00000000
0x10009a40
0x10009a40
0x10009a44
0x10009a45
0x10009a45
0x00000000
0x10009a4d
0x10009a4d
0x10009a4f
0x10009c10
0x10009c13
0x10009c18
0x10009c1d
0x10009c21
0x10009c25
0x10009a55
0x10009a55
0x10009a10
0x10009a12
0x10009c30
0x10009c33
0x10009c38
0x10009c3c
0x10009c41
0x10009c45
0x10009a18
0x10009a18
0x10009a1a
0x00000000
0x10009a20
0x10009a20
0x10009a23
0x10009a28
0x10009a2d
0x10009a31
0x10009a35
0x10009a35
0x10009a1a
0x10009a57
0x10009a57
0x10009a60
0x10009b90
0x10009b90
0x10009b93
0x10009b95
0x10009a66
0x10009a66
0x10009a69
0x10009a6e
0x10009a73
0x10009a77
0x10009a7b
0x10009a7b
0x10009a60
0x10009a55
0x00000000
0x1000977a
0x1000977a
0x1000977c
0x100098ff
0x100098ff
0x10009901
0x10009bd0
0x10009bd3
0x10009bd8
0x10009bdd
0x10009be1
0x10009be5
0x10009907
0x10009907
0x10009909
0x100098e0
0x100098e2
0x10009bb0
0x10009bb3
0x10009bb8
0x10009bbc
0x10009bc1
0x10009bc5
0x100098e8
0x100098e8
0x100098eb
0x100098ed
0x100098ed
0x1000990b
0x1000990b
0x1000990e
0x10009913
0x10009918
0x1000991c
0x10009920
0x10009920
0x10009909
0x100098f2
0x100098f6
0x100098f7
0x100098f7
0x10009782
0x100097cd
0x100097cd
0x100097cf
0x10009bf0
0x10009bf3
0x10009bf8
0x10009bfd
0x10009c01
0x10009c05
0x100097d5
0x100097d5
0x10009788
0x1000978a
0x10009c50
0x10009c53
0x10009c58
0x10009c5c
0x10009c61
0x10009c65
0x10009790
0x10009790
0x10009792
0x00000000
0x10009798
0x10009798
0x1000979b
0x100097a0
0x100097a4
0x100097a9
0x100097ad
0x100097ad
0x10009792
0x100097d7
0x100097d7
0x100097e0
0x10009b80
0x10009b80
0x10009b83
0x10009b85
0x100097e6
0x100097e6
0x100097e9
0x100097ee
0x100097f3
0x100097f7
0x100097fb
0x100097fb
0x100097e0
0x100097d5
0x00000000
0x100097c0
0x100097c0
0x100097c4
0x100097c5
0x100097c5
0x100097cd
0x1000977c
0x10009774
0x10009766
0x10009869
0x10009869
0x10009869
0x00000000

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097AD
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
strchr.MSVCRT ref: 1000983B
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009920
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C05

Strings

', xrefs: 10009A23, 10009AFB
>, xrefs: 100097E9, 1000990E, 10009A69, 10009AC3
<, xrefs: 10009ADF, 10009BD3, 10009BF3, 10009C13
'\'', xrefs: 100098C3
&, xrefs: 1000979B, 10009AA7, 10009BB3, 10009C33
", xrefs: 10009B1A, 10009C53

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf$strchr
String ID: &$'$>$<$"$'\''
API String ID: 2626076477-3929336650
Opcode ID: 12b6750b4a52a26ed5acad3795ae941bdf77578173880ce7d0d3f74c73066fa8
Instruction ID: db27ddebd36c8a04df1f9b29fc46dfe65a5f1e33d3c32a01edac565b911f7663
Opcode Fuzzy Hash: 12b6750b4a52a26ed5acad3795ae941bdf77578173880ce7d0d3f74c73066fa8
Instruction Fuzzy Hash: 7BD18174908B95CAE710DF29804076EBBE1FF826C0F56881EF9D58B20AD735E985D783

Uniqueness

Uniqueness Score: -1.00%

Function 10015A2B Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10016E19: mv_mallocz.MAIN ref: 10016ECF

mv_mallocz.MAIN ref: 10015A99

Strings

*, xrefs: 10015A8F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz
String ID: *
API String ID: 1901900789-163128923
Opcode ID: f34b66a1ccc27e32b7c57b1c91422b2d98364e726381d3d9b355eaa3350dc528
Instruction ID: 14329a75bb3270f280874b1f9c34d30974718639eef1760a85213997015026ea
Opcode Fuzzy Hash: f34b66a1ccc27e32b7c57b1c91422b2d98364e726381d3d9b355eaa3350dc528
Instruction Fuzzy Hash: 5791D4B9608701CFC344DF64D48141ABBE1FF88354F558A2EE8989F316D736E9868F92

Uniqueness

Uniqueness Score: -1.00%

Function 10028940 Relevance: 47.4, APIs: 14, Strings: 13, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_log.MAIN ref: 10028A2C
mv_log.MAIN ref: 10028A75

Strings

DBL_MAX, xrefs: 10028B62
INT_MAX, xrefs: 10028A63
FLT_MIN, xrefs: 10028B23
I64_MAX, xrefs: 10028A83
DBL_MIN, xrefs: 10028B81
-DBL_MAX, xrefs: 10028BC5
FLT_MAX, xrefs: 10028B03
-FLT_MIN, xrefs: 10028B43
INT_MIN, xrefs: 10028A3B
UINT32_MAX, xrefs: 10028AC3
I64_MIN, xrefs: 10028AA3
-FLT_MAX, xrefs: 10028AE3
-DBL_MIN, xrefs: 10028A1A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: -DBL_MAX$-DBL_MIN$-FLT_MAX$-FLT_MIN$DBL_MAX$DBL_MIN$FLT_MAX$FLT_MIN$I64_MAX$I64_MIN$INT_MAX$INT_MIN$UINT32_MAX
API String ID: 2418673259-2628725902
Opcode ID: 6453b15dceaf4b7331f14c8ad6eaaf5a7c0dbe11f287a6335f0ed953db9f3e8b
Instruction ID: c151ce863bab8d22e13df11496c1752d1bc59b589b709a0be275ec7c3333394e
Opcode Fuzzy Hash: 6453b15dceaf4b7331f14c8ad6eaaf5a7c0dbe11f287a6335f0ed953db9f3e8b
Instruction Fuzzy Hash: DC5133BD8067009ED355DF25B05121EFBE0FF84740FE5C92EA5C957211EB399685AB03

Uniqueness

Uniqueness Score: -1.00%

Function 100195E0 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10019633
mv_calloc.MAIN ref: 1001964E
MultiByteToWideChar.KERNEL32 ref: 10019685
mv_calloc.MAIN ref: 100196D7
mv_freep.MAIN ref: 10019713
wcslen.MSVCRT ref: 1001971F
_wsopen.MSVCRT ref: 1001974B
mv_freep.MAIN ref: 10019758
_sopen.MSVCRT ref: 1001978A
_errno.MSVCRT ref: 100197F5
wcslen.MSVCRT ref: 1001981B
mv_calloc.MAIN ref: 10019857
wcscpy.MSVCRT ref: 10019872
wcscat.MSVCRT ref: 10019882
mv_freep.MAIN ref: 1001988A
_errno.MSVCRT ref: 100198E1
mv_freep.MAIN ref: 100198F4
mv_calloc.MAIN ref: 10019912
wcscpy.MSVCRT ref: 10019929
wcscat.MSVCRT ref: 1001993C
_errno.MSVCRT ref: 10019946
_errno.MSVCRT ref: 10019958

Strings

\\?\UNC\, xrefs: 10019920
\\?\, xrefs: 10019869

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _errnomv_callocmv_freep$ByteCharMultiWidewcscatwcscpywcslen$_sopen_wsopen
String ID: \\?\$\\?\UNC\
API String ID: 2585690843-3019864461
Opcode ID: 3b770d789a6b7b9b259c4104553542867824734224feeea9d00b87784f6ee047
Instruction ID: f678d7e62f75a51a3396b5e92a4772b9af71e601e6ce56c2c03e9c047c1b1921
Opcode Fuzzy Hash: 3b770d789a6b7b9b259c4104553542867824734224feeea9d00b87784f6ee047
Instruction Fuzzy Hash: 8F91C2B49097119FD350EF69C98421EBBE0FF89754F55892EF898CB390E774D8809B82

Uniqueness

Uniqueness Score: -1.00%

Function 100118C0 Relevance: 43.8, APIs: 29, Instructions: 289
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_get_token.MAIN ref: 10011913

Part of subcall function 10006940: strlen.MSVCRT ref: 10006950
Part of subcall function 10006940: mv_malloc.MAIN ref: 10006959
Part of subcall function 10006940: strspn.MSVCRT ref: 10006980
Part of subcall function 10006940: strspn.MSVCRT ref: 100069C1

mv_freep.MAIN ref: 10011930
mv_freep.MAIN ref: 1001193C
strspn.MSVCRT ref: 1001195F
mv_get_token.MAIN ref: 1001197C
mv_strdup.MAIN ref: 100119B2
mv_strdup.MAIN ref: 100119CA
mv_freep.MAIN ref: 10011A5F
mv_freep.MAIN ref: 10011A6B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$strspn$mv_get_tokenmv_strdup$mv_mallocstrlen
String ID:
API String ID: 2603649322-0
Opcode ID: a48f40283b9e65b32d1f5a6441022cda31c27f9d96bb31350562698b963a6cb7
Instruction ID: 9fb1d64ee0f767fe4cf9b76db285c661084ffa79d26213b968ed75a23716e163
Opcode Fuzzy Hash: a48f40283b9e65b32d1f5a6441022cda31c27f9d96bb31350562698b963a6cb7
Instruction Fuzzy Hash: D3B128759097419FC744DF25D58069EBBE5FF88690F96892EF8C89B311E730E980CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10015CEB Relevance: 42.2, APIs: 28, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10015A2B: mv_mallocz.MAIN ref: 10015A99

mv_expr_free.MAIN ref: 10015DA4
mv_expr_free.MAIN ref: 10015DB3
mv_expr_free.MAIN ref: 10015DC2
mv_freep.MAIN ref: 10015DD1
mv_freep.MAIN ref: 10015DDD
mv_expr_free.MAIN ref: 10015DFF
mv_expr_free.MAIN ref: 10015E0E
mv_expr_free.MAIN ref: 10015E1D
mv_freep.MAIN ref: 10015E2C
mv_freep.MAIN ref: 10015E38
mv_expr_free.MAIN ref: 10015E5A
mv_expr_free.MAIN ref: 10015E69
mv_expr_free.MAIN ref: 10015E78
mv_freep.MAIN ref: 10015E87
mv_freep.MAIN ref: 10015E93
mv_freep.MAIN ref: 10015EAA
mv_freep.MAIN ref: 10015EB6
mv_freep.MAIN ref: 10015F16
mv_freep.MAIN ref: 10015F22
mv_expr_free.MAIN ref: 10015F07

Part of subcall function 10015280: mv_freep.MAIN ref: 10015588
Part of subcall function 10015280: mv_freep.MAIN ref: 10015594
Part of subcall function 10015280: mv_freep.MAIN ref: 100155DB
Part of subcall function 10015280: mv_freep.MAIN ref: 100155E7
Part of subcall function 10015280: mv_freep.MAIN ref: 100155F6
Part of subcall function 10015280: mv_freep.MAIN ref: 10015602
Part of subcall function 10015280: mv_freep.MAIN ref: 10015667
Part of subcall function 10015280: mv_freep.MAIN ref: 10015673
Part of subcall function 10015280: mv_freep.MAIN ref: 100156BA

mv_expr_free.MAIN ref: 10015EF8

Part of subcall function 10015280: mv_freep.MAIN ref: 1001542C
Part of subcall function 10015280: mv_freep.MAIN ref: 10015438
Part of subcall function 10015280: mv_freep.MAIN ref: 10015447
Part of subcall function 10015280: mv_freep.MAIN ref: 10015453
Part of subcall function 10015280: mv_freep.MAIN ref: 1001549A
Part of subcall function 10015280: mv_freep.MAIN ref: 100154A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100154B5
Part of subcall function 10015280: mv_freep.MAIN ref: 100154C1
Part of subcall function 10015280: mv_freep.MAIN ref: 10015517
Part of subcall function 10015280: mv_freep.MAIN ref: 10015523

mv_expr_free.MAIN ref: 10015EE9

Part of subcall function 10015280: mv_freep.MAIN ref: 100152FA
Part of subcall function 10015280: mv_freep.MAIN ref: 10015306
Part of subcall function 10015280: mv_freep.MAIN ref: 1001534D
Part of subcall function 10015280: mv_freep.MAIN ref: 10015359
Part of subcall function 10015280: mv_freep.MAIN ref: 10015368
Part of subcall function 10015280: mv_freep.MAIN ref: 10015374
Part of subcall function 10015280: mv_freep.MAIN ref: 100153D9
Part of subcall function 10015280: mv_freep.MAIN ref: 100153E5

mv_expr_free.MAIN ref: 10015F35
mv_expr_free.MAIN ref: 10015F44
mv_expr_free.MAIN ref: 10015F53
mv_freep.MAIN ref: 10015F62
mv_freep.MAIN ref: 10015F6E

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_expr_free$mv_mallocz
String ID:
API String ID: 3790364031-0
Opcode ID: 3e6e36390cfd9e5eea5f002cb839298052107fabee4b70dce1ad53e7584ae73a
Instruction ID: 4a1cff7b7193ad05352c2a1d7c2ddd1ff027f89b0b70413f8a5602202c5e936b
Opcode Fuzzy Hash: 3e6e36390cfd9e5eea5f002cb839298052107fabee4b70dce1ad53e7584ae73a
Instruction Fuzzy Hash: 8A81D5B9608711CFC744EF64D48141ABBE1FF88315F458A6EE8989F305D736E9868F82

Uniqueness

Uniqueness Score: -1.00%

Function 1001C790 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 231
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E1001C790(void* __eflags, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v40;
				intOrPtr _t10;
				void* _t11;
				intOrPtr* _t12;
				signed int _t16;
				intOrPtr _t17;
				intOrPtr* _t18;
				void* _t19;
				intOrPtr* _t21;
				void* _t22;
				intOrPtr* _t23;

				_t10 = 0x100b2e05;
				_t16 = 0;
				_t23 = _t22 - 0x1c;
				_t21 = _a4;
				_t17 = _a8;
				 *_t21 = 0;
				while(1) {
					_v40 = _t10;
					 *_t23 = _t17;
					_t11 = E10006B30();
					_t19 = _t11;
					if(_t11 == 0) {
						break;
					}
					_t16 = _t16 + 1;
					if(_t16 != 0xf) {
						_t10 =  *((intOrPtr*)(0x100b3000 + _t16 * 8));
						continue;
					} else {
						return 0xffffffea;
					}
					L19:
				}
				 *_t23 = 0x10;
				_t12 = E100265E0();
				_t18 = _t12;
				if(_t12 == 0) {
					L18:
					_t19 = 0xfffffff4;
				} else {
					 *(_t12 + 4) = _t16;
					if(_t16 > 0xd) {
						L10:
						 *_t21 = _t18;
					} else {
						switch( *((intOrPtr*)(_t16 * 4 +  &M100B2E0C))) {
							case 0:
								__eax = E10025C70();
								goto L9;
							case 1:
								__eax = E100274A0();
								goto L9;
							case 2:
								__eax = E10039950();
								goto L9;
							case 3:
								__eax = E1003E680();
								goto L9;
							case 4:
								_t14 = E10049740();
								L9:
								 *_t18 = _t14;
								if(_t14 == 0) {
									 *_t23 = _t18;
									L100265B0();
									goto L18;
								} else {
									goto L10;
								}
								goto L11;
							case 5:
								 *((intOrPtr*)(__edi + 8)) = L1000FDB0(__ebx, 4);
								goto L10;
						}
					}
				}
				L11:
				return _t19;
				goto L19;
			}

0x1001c791
0x1001c799
0x1001c79b
0x1001c79e
0x1001c7a2
0x1001c7a6
0x1001c7b7
0x1001c7b7
0x1001c7bb
0x1001c7be
0x1001c7c5
0x1001c7c7
0x00000000
0x00000000
0x1001c7c9
0x1001c7cd
0x1001c7b0
0x00000000
0x1001c7cf
0x1001c7dd
0x1001c7dd
0x00000000
0x1001c7cd
0x1001c7e0
0x1001c7e7
0x1001c7ee
0x1001c7f0
0x1001c865
0x1001c865
0x1001c7f2
0x1001c7f2
0x1001c7f8
0x1001c813
0x1001c813
0x1001c7fa
0x1001c7fa
0x00000000
0x1001c848
0x00000000
0x00000000
0x1001c852
0x00000000
0x00000000
0x1001c820
0x00000000
0x00000000
0x1001c830
0x00000000
0x00000000
0x1001c808
0x1001c80d
0x1001c80d
0x1001c811
0x1001c859
0x1001c860
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1001c843
0x00000000
0x00000000
0x1001c7fa
0x1001c7f8
0x1001c816
0x1001c81f
0x00000000

APIs

mv_strcasecmp.MAIN ref: 1001C7BE
mv_mallocz.MAIN ref: 1001C7E7

Strings

MD5, xrefs: 1001C791

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_malloczmv_strcasecmp
String ID: MD5
API String ID: 1451953452-1168476579
Opcode ID: fd8ebb722839f17aaf6157ba037008f289ae86b4bf847cb60b004431fafa5101
Instruction ID: eb5494de89beb9ab75199d641261a1b3f1512631375a939401cd0d8990c0213e
Opcode Fuzzy Hash: fd8ebb722839f17aaf6157ba037008f289ae86b4bf847cb60b004431fafa5101
Instruction Fuzzy Hash: BB91F4B4909705DFC710DF68C080A1EBBE0FF89354F55896EE9888B362E735D980EB56

Uniqueness

Uniqueness Score: -1.00%

Function 10011560 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 216
stringCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E10011560(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr __ebp, signed int* _a4, signed int* _a8, signed int _a12, intOrPtr _a16, signed int _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v50;
				void* _v56;
				void* _v60;
				void* _v64;
				intOrPtr _v92;
				signed int _v96;
				signed int* _v100;
				signed int* _v104;
				signed int* _t89;
				signed int* _t98;
				signed int* _t99;
				signed int _t104;
				void* _t105;
				int _t109;
				int _t110;
				void* _t112;
				signed int _t116;
				signed int* _t121;
				signed int _t127;
				int _t129;
				signed int _t130;
				intOrPtr* _t133;
				signed int* _t134;
				void* _t136;
				signed int* _t140;
				signed int* _t142;
				int _t143;
				void* _t144;
				signed int* _t149;
				void* _t150;
				signed int* _t152;
				signed int _t153;
				int _t155;
				signed int _t156;
				void _t158;
				signed int** _t162;
				signed int** _t163;

				_v16 = __ebx;
				_v12 = __esi;
				_v104 = 0x16;
				_t149 =  &_v50;
				 *_t163 = _t149;
				_v92 = _a16;
				_v96 = _a12;
				_v100 = 0x100b1200;
				_v8 = __edi;
				_t140 = _a8;
				_v4 = __ebp;
				E10011040();
				_v60 = 0;
				_t121 =  *_a4;
				 *_t163 = _t149;
				_v56 = 0;
				_t89 = E100267C0(_t121, _t140, _t149, 0);
				_v56 = _t89;
				if(_t140 == 0) {
					_t150 = 0xffffffea;
					L24:
					if(_t121 == 0) {
						L16:
						 *_t163 = _v60;
						L100265B0();
						 *_t163 = _v56;
						L100265B0();
						L17:
						return _t150;
					}
					L15:
					if( *_t121 == 0) {
						 *_t163 =  &(_t121[1]);
						E100265C0();
						 *_t163 = _a4;
						E100265C0();
					}
					goto L16;
				}
				_t162 = 0;
				_t152 = _t89;
				if((_a20 & 0x00000040) == 0) {
					_v104 = _t140;
					_v100 = 0;
					 *_t163 = _t121;
					_v96 = _a20 & 0xfffffff7;
					_t162 = E100110D0();
				}
				if((_a20 & 0x00000004) == 0) {
					 *_t163 = _t140;
					_t98 = E100267C0(_t121, _t140, _t152, _t162);
					_v60 = _t98;
					_t142 = _t98;
					if(_t121 == 0) {
						L19:
						 *_t163 = 8;
						_t99 = E100265E0();
						_t142 = _v60;
						_t121 = _t99;
						 *_a4 = _t121;
						if(_t121 == 0 || _t142 == 0) {
							_t150 = 0xfffffff4;
							goto L24;
						} else {
							L21:
							_t152 = _v56;
							L4:
							if(_t152 == 0) {
								L14:
								_t150 = 0xfffffff4;
								goto L15;
							}
							if(_t162 == 0) {
								_v100 = 8;
								_v104 =  *_t121 + 1;
								 *_t163 = _t121[1];
								_t104 = E100264F0();
								_t153 = _t104;
								if(_t104 == 0) {
									goto L14;
								}
								_t121[1] = _t104;
								_t127 =  *_t121;
								L10:
								_t105 = _v56;
								if(_t105 == 0) {
									if(_t127 == 0) {
										 *_t163 =  &(_t121[1]);
										E100265C0();
										 *_t163 = _a4;
										E100265C0();
									}
									_t150 = 0;
									 *_t163 =  &_v60;
									E100265C0();
								} else {
									_t133 = _t153 + _t127 * 8;
									 *((intOrPtr*)(_t133 + 4)) = _t105;
									 *_t133 = _v60;
									_t150 = 0;
									 *_t121 = _t127 + 1;
								}
								goto L17;
							}
							if((_a20 & 0x00000010) != 0) {
								 *_t163 = _t142;
								_t150 = 0;
								L100265B0();
								 *_t163 = _v56;
								L100265B0();
								goto L17;
							}
							_t134 = _a4;
							 *_t163 = _t134;
							if((_a20 & 0x00000020) != 0) {
								_v64 = _t134;
								_t109 = strlen(??);
								 *_t163 = _t152;
								_t143 = _t109;
								_t110 = strlen(??);
								 *_t163 = _v64;
								_t155 = _t110;
								_t68 = _t110 + 1; // 0x1
								_v104 = _t143 + _t68;
								_t112 = E10026280();
								if(_t112 == 0) {
									goto L14;
								}
								_t70 = _t155 + 1; // 0x1
								_t129 = _t70;
								_t144 = _t143 + _t112;
								_t136 = _v56;
								if(_t129 >= 8) {
									if((_t144 & 0x00000001) != 0) {
										_t130 =  *_t136 & 0x000000ff;
										_t144 = _t144 + 1;
										_t136 = _t136 + 1;
										 *(_t144 - 1) = _t130;
										_t129 = _t155;
									}
									if((_t144 & 0x00000002) != 0) {
										_t156 =  *_t136 & 0x0000ffff;
										_t144 = _t144 + 2;
										_t136 = _t136 + 2;
										_t129 = _t129 - 2;
										 *(_t144 - 2) = _t156;
									}
									if((_t144 & 0x00000004) != 0) {
										_t158 =  *_t136;
										_t144 = _t144 + 4;
										_t136 = _t136 + 4;
										_t129 = _t129 - 4;
										 *(_t144 - 4) = _t158;
									}
								}
								_v64 = _t112;
								memcpy(_t144, _t136, _t129);
								_t163 =  &(_t163[3]);
								 *_t163 =  &_v56;
								E100265C0();
								_v56 = _v64;
								goto L9;
							} else {
								L100265B0();
								L9:
								 *_t163 =  *_t162;
								L100265B0();
								_t116 =  *_t121;
								_t153 = _t121[1];
								_t32 = _t116 - 1; // -1
								_t127 = _t32;
								 *_t121 = _t127;
								 *_t162 =  *(_t153 + _t127 * 8);
								_a4 =  *(_t153 + 4 + _t127 * 8);
								goto L10;
							}
						}
					}
					if(_t98 != 0) {
						goto L21;
					}
					goto L14;
				}
				_v60 = _t140;
				if(_t121 == 0) {
					goto L19;
				}
				goto L4;
			}

0x10011563
0x1001156b
0x10011578
0x1001157c
0x10011580
0x10011583
0x1001158c
0x10011590
0x10011594
0x10011598
0x1001159c
0x100115a2
0x100115ab
0x100115af
0x100115b3
0x100115b6
0x100115ba
0x100115c1
0x100115c5
0x10011758
0x1001175d
0x1001175f
0x10011699
0x1001169d
0x100116a0
0x100116a9
0x100116ac
0x100116b1
0x100116c6
0x100116c6
0x1001168f
0x10011693
0x10011773
0x10011776
0x1001177f
0x10011782
0x10011782
0x00000000
0x10011693
0x100115cb
0x100115cd
0x100115d7
0x100116d0
0x100116dd
0x100116e1
0x100116e7
0x100116f0
0x100116f0
0x100115e5
0x10011670
0x10011673
0x1001167a
0x1001167e
0x10011680
0x10011700
0x10011700
0x10011707
0x1001170c
0x10011710
0x10011718
0x1001171a
0x10011840
0x00000000
0x10011728
0x10011728
0x10011728
0x100115f7
0x100115f9
0x1001168a
0x1001168a
0x00000000
0x1001168a
0x10011601
0x100117b5
0x100117bc
0x100117c3
0x100117c6
0x100117cd
0x100117cf
0x00000000
0x00000000
0x100117d5
0x100117d8
0x10011650
0x10011650
0x10011656
0x10011792
0x10011853
0x10011856
0x1001185f
0x10011862
0x10011862
0x1001179c
0x1001179e
0x100117a1
0x1001165c
0x1001165c
0x10011664
0x10011667
0x10011669
0x1001166b
0x1001166b
0x00000000
0x10011656
0x1001160f
0x10011738
0x1001173b
0x1001173d
0x10011746
0x10011749
0x00000000
0x10011749
0x10011615
0x10011620
0x10011623
0x100117e0
0x100117e4
0x100117e9
0x100117ec
0x100117ee
0x100117f7
0x100117fa
0x100117fc
0x10011800
0x10011804
0x1001180b
0x00000000
0x00000000
0x10011811
0x10011811
0x10011814
0x10011816
0x1001181d
0x10011876
0x10011898
0x1001189b
0x1001189c
0x1001189d
0x100118a0
0x100118a0
0x1001187e
0x100118a4
0x100118a7
0x100118aa
0x100118ad
0x100118b0
0x100118b0
0x10011886
0x10011888
0x1001188a
0x1001188d
0x10011890
0x10011893
0x10011893
0x10011886
0x1001181f
0x10011825
0x10011825
0x1001182b
0x1001182e
0x10011837
0x00000000
0x10011629
0x10011629
0x1001162e
0x10011631
0x10011634
0x10011639
0x1001163b
0x1001163e
0x1001163e
0x10011641
0x1001164a
0x1001164d
0x00000000
0x1001164d
0x10011623
0x1001171a
0x10011684
0x00000000
0x00000000
0x00000000
0x10011684
0x100115eb
0x100115f1
0x00000000
0x00000000
0x00000000

APIs

mv_strdup.MAIN ref: 100115BA

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_strdup.MAIN ref: 10011673
mv_dict_get.MAIN ref: 100116EB
mv_mallocz.MAIN ref: 10011707
mv_freep.MAIN ref: 100117A1
mv_realloc_array.MAIN ref: 100117C6
strlen.MSVCRT ref: 100117E4
strlen.MSVCRT ref: 100117EE
mv_realloc.MAIN ref: 10011804
mv_freep.MAIN ref: 1001182E

Strings

, xrefs: 10011618
%lld, xrefs: 10011587

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$mv_freepmv_strdup$_aligned_reallocmv_dict_getmv_malloczmv_reallocmv_realloc_array
String ID: $%lld
API String ID: 420417855-3617178099
Opcode ID: d510e7aac1835d2d14d11394022ecc06c06f3c51c024d220679ff3e81abd8013
Instruction ID: 1aac3acce1ec20135028bdf280dbd7ca7379982b25da7d1f386a19304280214e
Opcode Fuzzy Hash: d510e7aac1835d2d14d11394022ecc06c06f3c51c024d220679ff3e81abd8013
Instruction Fuzzy Hash: 0C912AB5909751CBC754DF28C58065EBBE0FF88384F56892DED848B345EB74E884DB82

Uniqueness

Uniqueness Score: -1.00%

Function 100192E0 Relevance: 38.6, APIs: 18, Strings: 4, Instructions: 150fileCOMMON

Download Yara Rule

APIs

mvpriv_open.MAIN ref: 1001933F

Part of subcall function 100195E0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10019633
Part of subcall function 100195E0: mv_calloc.MAIN ref: 1001964E
Part of subcall function 100195E0: MultiByteToWideChar.KERNEL32 ref: 10019685
Part of subcall function 100195E0: mv_calloc.MAIN ref: 100196D7
Part of subcall function 100195E0: mv_freep.MAIN ref: 10019713
Part of subcall function 100195E0: wcslen.MSVCRT ref: 1001971F
Part of subcall function 100195E0: _wsopen.MSVCRT ref: 1001974B

_fstat64.MSVCRT ref: 10019366
_close.MSVCRT ref: 10019394
_get_osfhandle.MSVCRT ref: 100193C5
CreateFileMappingA.KERNEL32 ref: 100193ED
MapViewOfFile.KERNEL32 ref: 10019422
CloseHandle.KERNEL32 ref: 10019434
mv_log.MAIN ref: 1001945D
_close.MSVCRT ref: 10019465
_errno.MSVCRT ref: 10019480
mv_strerror.MAIN ref: 100194A1
mv_log.MAIN ref: 100194C7
_errno.MSVCRT ref: 100194D8
mv_strerror.MAIN ref: 100194FE
mv_log.MAIN ref: 1001951B
_close.MSVCRT ref: 10019523
mv_log.MAIN ref: 1001954F
_close.MSVCRT ref: 10019557

Strings

Cannot read file '%s': %s, xrefs: 100194A6
File size for file '%s' is too big, xrefs: 10019535
Error occurred in fstat(): %s, xrefs: 1001950B
Error occurred in CreateFileMapping(), xrefs: 10019561

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _closemv_log$ByteCharFileMultiWide_errnomv_callocmv_strerror$CloseCreateHandleMappingView_fstat64_get_osfhandle_wsopenmv_freepmvpriv_openwcslen
String ID: Cannot read file '%s': %s$Error occurred in CreateFileMapping()$Error occurred in fstat(): %s$File size for file '%s' is too big
API String ID: 2213036534-2445208470
Opcode ID: 115248d222d0207b4b6978023f43e634846f62dc27148f7a7cd2e032391e2a57
Instruction ID: 617e9db2a449c1ebb97318d6d46501e643e1f1538bb2456b081f200f3c68d203
Opcode Fuzzy Hash: 115248d222d0207b4b6978023f43e634846f62dc27148f7a7cd2e032391e2a57
Instruction Fuzzy Hash: 6861C0B59097459FC310EF29C48529EFBE4FF88700F41892EE9D98B351E774E9809B82

Uniqueness

Uniqueness Score: -1.00%

Function 10012850 Relevance: 37.7, APIs: 25, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10012850(intOrPtr* __eax) {
				intOrPtr _t65;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr _t88;
				intOrPtr _t90;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				intOrPtr* _t98;
				intOrPtr* _t102;
				intOrPtr* _t106;
				intOrPtr* _t107;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;

				_t107 = __eax;
				_t111 = _t110 - 0x2c;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					_t96 = 0;
					do {
						_t90 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 8)) + _t96 * 4));
						_t96 = _t96 + 1;
						 *_t111 = _t90;
						L100265B0();
					} while (_t96 <  *((intOrPtr*)(__eax + 0xc)));
				}
				_t106 =  *((intOrPtr*)(_t107 + 0x1c));
				if(_t106 != 0) {
					if( *((intOrPtr*)(_t106 + 0xc)) != 0) {
						_t95 = 0;
						do {
							_t88 =  *((intOrPtr*)( *((intOrPtr*)(_t106 + 8)) + _t95 * 4));
							_t95 = _t95 + 1;
							 *_t111 = _t88;
							L100265B0();
						} while (_t95 <  *((intOrPtr*)(_t106 + 0xc)));
					}
					_t109 =  *((intOrPtr*)(_t106 + 0x1c));
					if(_t109 != 0) {
						if( *((intOrPtr*)(_t109 + 0xc)) != 0) {
							_t94 = 0;
							do {
								_t86 =  *((intOrPtr*)( *((intOrPtr*)(_t109 + 8)) + _t94 * 4));
								_t94 = _t94 + 1;
								 *_t111 = _t86;
								L100265B0();
							} while (_t94 <  *((intOrPtr*)(_t109 + 0xc)));
						}
						_t102 =  *((intOrPtr*)(_t109 + 0x1c));
						if(_t102 != 0) {
							if( *((intOrPtr*)(_t102 + 0xc)) != 0) {
								_t93 = 0;
								do {
									 *((intOrPtr*)(_t111 + 0x18)) = _t102;
									_t84 =  *((intOrPtr*)( *((intOrPtr*)(_t102 + 8)) + _t93 * 4));
									_t93 = _t93 + 1;
									 *_t111 = _t84;
									L100265B0();
									_t102 =  *((intOrPtr*)(_t111 + 0x18));
								} while (_t93 <  *((intOrPtr*)(_t102 + 0xc)));
							}
							_t98 =  *((intOrPtr*)(_t102 + 0x1c));
							if(_t98 != 0) {
								if( *((intOrPtr*)(_t98 + 0xc)) != 0) {
									_t92 = 0;
									do {
										 *((intOrPtr*)(_t111 + 0x1c)) = _t102;
										 *((intOrPtr*)(_t111 + 0x18)) = _t98;
										_t82 =  *((intOrPtr*)( *((intOrPtr*)(_t98 + 8)) + _t92 * 4));
										_t92 = _t92 + 1;
										 *_t111 = _t82;
										L100265B0();
										_t98 =  *((intOrPtr*)(_t111 + 0x18));
										_t102 =  *((intOrPtr*)(_t111 + 0x1c));
									} while (_t92 <  *((intOrPtr*)(_t98 + 0xc)));
								}
								_t76 =  *((intOrPtr*)(_t98 + 0x1c));
								if( *((intOrPtr*)(_t98 + 0x1c)) != 0) {
									 *((intOrPtr*)(_t111 + 0x1c)) = _t98;
									 *((intOrPtr*)(_t111 + 0x18)) = _t102;
									E10012850(_t76);
									_t98 =  *((intOrPtr*)(_t111 + 0x1c));
									_t102 =  *((intOrPtr*)(_t111 + 0x18));
								}
								 *((intOrPtr*)(_t111 + 0x1c)) = _t102;
								 *((intOrPtr*)(_t111 + 0x18)) = _t98;
								 *_t111 =  *_t98;
								L100265B0();
								 *_t111 =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x18)) + 8));
								L100265B0();
								 *_t111 =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x18)) + 0x14));
								L100265B0();
								 *_t111 =  *((intOrPtr*)(_t111 + 0x18));
								L100265B0();
								_t102 =  *((intOrPtr*)(_t111 + 0x1c));
							}
							 *((intOrPtr*)(_t111 + 0x18)) = _t102;
							 *_t111 =  *_t102;
							L100265B0();
							 *_t111 =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x18)) + 8));
							L100265B0();
							 *_t111 =  *((intOrPtr*)( *((intOrPtr*)(_t111 + 0x18)) + 0x14));
							L100265B0();
							 *_t111 =  *((intOrPtr*)(_t111 + 0x18));
							L100265B0();
						}
						 *_t111 =  *_t109;
						L100265B0();
						 *_t111 =  *((intOrPtr*)(_t109 + 8));
						L100265B0();
						 *_t111 =  *((intOrPtr*)(_t109 + 0x14));
						L100265B0();
						 *_t111 = _t109;
						L100265B0();
					}
					 *_t111 =  *_t106;
					L100265B0();
					 *_t111 =  *((intOrPtr*)(_t106 + 8));
					L100265B0();
					 *_t111 =  *((intOrPtr*)(_t106 + 0x14));
					L100265B0();
					 *_t111 = _t106;
					L100265B0();
				}
				 *_t111 =  *_t107;
				L100265B0();
				 *_t111 =  *((intOrPtr*)(_t107 + 8));
				L100265B0();
				_t65 =  *((intOrPtr*)(_t107 + 0x14));
				 *_t111 = _t65;
				L100265B0();
				 *_t111 = _t107;
				L100265B0();
				return _t65;
			}

0x10012853
0x10012856
0x1001285e
0x10012860
0x10012870
0x10012873
0x10012876
0x10012877
0x1001287a
0x1001287f
0x10012870
0x10012884
0x10012889
0x10012894
0x10012896
0x100128a0
0x100128a3
0x100128a6
0x100128a7
0x100128aa
0x100128af
0x100128a0
0x100128b4
0x100128b9
0x100128c4
0x100128c6
0x100128d0
0x100128d3
0x100128d6
0x100128d7
0x100128da
0x100128df
0x100128d0
0x100128e4
0x100128e9
0x100128f4
0x100128f6
0x10012900
0x10012900
0x10012907
0x1001290a
0x1001290b
0x1001290e
0x10012913
0x10012917
0x10012900
0x1001291c
0x10012921
0x1001292c
0x1001292e
0x10012930
0x10012930
0x10012937
0x1001293b
0x1001293e
0x1001293f
0x10012942
0x10012947
0x1001294b
0x1001294f
0x10012930
0x10012954
0x10012959
0x1001295b
0x1001295f
0x10012963
0x10012968
0x1001296c
0x1001296c
0x10012970
0x10012976
0x1001297a
0x1001297d
0x10012989
0x1001298c
0x10012998
0x1001299b
0x100129a4
0x100129a7
0x100129ac
0x100129ac
0x100129b0
0x100129b6
0x100129b9
0x100129c5
0x100129c8
0x100129d4
0x100129d7
0x100129e0
0x100129e3
0x100129e3
0x100129eb
0x100129ee
0x100129f6
0x100129f9
0x10012a01
0x10012a04
0x10012a09
0x10012a0c
0x10012a0c
0x10012a13
0x10012a16
0x10012a1e
0x10012a21
0x10012a29
0x10012a2c
0x10012a31
0x10012a34
0x10012a34
0x10012a3b
0x10012a3e
0x10012a46
0x10012a49
0x10012a4e
0x10012a51
0x10012a54
0x10012a59
0x10012a5c
0x10012a68

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de691f1ba13835e21657e86075408ec6b0dc09785dc25b7b1d0ef4953b892b6e
Instruction ID: 2f248bfe3db45479d33083a71d7c86b86264631c37f86e05a0edac7835ee7c2e
Opcode Fuzzy Hash: de691f1ba13835e21657e86075408ec6b0dc09785dc25b7b1d0ef4953b892b6e
Instruction Fuzzy Hash: 2A6192B8A04B558FC704EF69D4C191AB7E0FF48254F51891CE9948B31AEB30F896CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 10011D20 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 307
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E10011D20(signed int* _a4, intOrPtr* _a8, signed int _a12) {
				signed char* _v32;
				signed int* _v36;
				signed char _v48;
				void* _v52;
				void* _v56;
				int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int** _v76;
				signed char _v80;
				signed int* _v84;
				signed int* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int* _t155;
				signed int** _t165;
				signed int* _t167;
				signed int* _t168;
				int _t170;
				signed int _t172;
				signed int* _t178;
				int _t186;
				signed char _t188;
				signed char* _t191;
				signed int _t193;
				signed int** _t194;
				void* _t195;
				signed int* _t200;
				intOrPtr* _t201;
				signed int* _t202;
				signed char _t205;
				void* _t218;
				intOrPtr* _t220;
				intOrPtr _t222;
				signed int** _t223;
				signed char _t224;
				intOrPtr _t225;
				signed int* _t226;
				signed int _t229;
				int _t231;
				short* _t232;
				signed int* _t237;
				signed int* _t238;
				signed char* _t240;
				int _t242;
				signed char* _t243;
				signed short* _t245;
				intOrPtr* _t247;
				intOrPtr* _t248;
				signed int* _t249;
				void* _t251;
				signed int** _t252;

				_t252 = _t251 - 0x4c;
				_t248 = _a8;
				if(_t248 == 0) {
					L23:
					return 0;
				} else {
					_t193 = 0;
					_t220 = _t248;
					_v72 = _a12 & 0x00000008;
					_v68 = _a12 & 0x00000040;
					_v64 = _a12 & 0x00000004;
					if( *_t220 > 0) {
						while(1) {
							_t194 =  *((intOrPtr*)(_t220 + 4)) + _t193 * 8;
							if(_t194 == 0) {
								goto L23;
							}
							_t237 =  *_t194;
							_v36 = 0;
							_t226 = _t194[1];
							_t249 =  *_a4;
							_v32 = 0;
							if(_v72 == 0) {
								if(_t226 == 0) {
									goto L5;
								} else {
									 *_t252 = _t226;
									_a8 = _t220;
									_t191 = E100267C0(_t194, _t226, _t237, _t249);
									_t220 = _a8;
									_v32 = _t191;
									if(_t237 != 0) {
										goto L6;
									} else {
										goto L26;
									}
								}
							} else {
								_v32 = _t226;
								L5:
								if(_t237 == 0) {
									L26:
									_t155 = _t249;
									_t195 = 0xffffffea;
									goto L27;
								} else {
									L6:
									_v76 = 0;
									if(_v68 == 0) {
										_v88 = _t237;
										 *_t252 = _t249;
										_a8 = _t220;
										_v80 = _a12;
										_v84 = 0;
										_t165 = E100110D0();
										_t220 = _a8;
										_v76 = _t165;
									}
									if(_v64 == 0) {
										 *_t252 = _t237;
										_a8 = _t220;
										_t167 = E100267C0(_t194, _t226, _t237, _t249);
										_t220 = _a8;
										_v36 = _t167;
										_t238 = _t167;
										if(_t249 == 0) {
											goto L34;
										} else {
											if(_t167 == 0) {
												goto L11;
											} else {
												goto L9;
											}
										}
									} else {
										_v36 = _t237;
										if(_t249 == 0) {
											L34:
											 *_t252 = 8;
											_a8 = _t220;
											_t168 = E100265E0();
											_t238 = _v36;
											_t249 = _t168;
											 *_a4 = _t249;
											if(_t249 == 0) {
												L36:
												_t155 = _t249;
												_t195 = 0xfffffff4;
												L27:
												if(_t155 != 0) {
													goto L12;
												}
												goto L13;
											} else {
												_t220 = _a8;
												if(_t238 != 0) {
													goto L9;
												} else {
													goto L36;
												}
											}
										} else {
											L9:
											_t170 = _v32;
											_v60 = _t170;
											if(_t226 == 0 || _t170 != 0) {
												if(_v76 == 0) {
													_t172 =  *_t249;
													if(_v60 == 0) {
														goto L40;
													} else {
														_a8 = _t220;
														_v84 = 8;
														_v88 = _t172 + 1;
														 *_t252 = _a4;
														_t178 = E100264F0();
														_t220 = _a8;
														_t200 = _t178;
														if(_t178 == 0) {
															goto L11;
														} else {
															_a4 = _t178;
															_t172 =  *_t249;
															goto L20;
														}
													}
												} else {
													if((_a12 & 0x00000010) != 0) {
														 *_t252 = _t238;
														_a8 = _t220;
														L100265B0();
														 *_t252 = _v32;
														L100265B0();
														_t220 = _a8;
														goto L22;
													} else {
														_t202 = _v76[1];
														if(_v60 == 0 || (_a12 & 0x00000020) == 0) {
															 *_t252 = _t202;
															_a8 = _t220;
															L100265B0();
															_t222 = _a8;
															L19:
															_a8 = _t222;
															 *_t252 =  *_v76;
															L100265B0();
															_t229 =  *_t249;
															_t200 = _a4;
															_t223 = _v76;
															_t41 = _t229 - 1; // 0x3
															_t172 = _t41;
															 *_t249 = _t172;
															 *_t223 =  *(_t200 + _t172 * 8);
															_t223[1] =  *(_t200 + 4 + _t172 * 8);
															_t220 = _a8;
															L20:
															_t240 = _v32;
															if(_t240 == 0) {
																L40:
																if(_t172 == 0) {
																	_a8 = _t220;
																	 *_t252 =  &_a4;
																	E100265C0();
																	 *_t252 = _a4;
																	E100265C0();
																	_t220 = _a8;
																}
																_a8 = _t220;
																 *_t252 =  &_v36;
																E100265C0();
																_t220 = _a8;
															} else {
																_t201 = _t200 + _t172 * 8;
																 *((intOrPtr*)(_t201 + 4)) = _t240;
																 *_t201 = _v36;
																 *_t249 = _t172 + 1;
															}
															L22:
															_t193 = (_t194 -  *((intOrPtr*)(_t220 + 4)) >> 3) + 1;
															if( *_t220 > _t193) {
																continue;
															} else {
																goto L23;
															}
														} else {
															 *_t252 = _t202;
															_a8 = _t220;
															_v56 = _t202;
															_t242 = strlen(??);
															 *_t252 = _v60;
															_t186 = strlen(??);
															 *_t252 = _v56;
															_t231 = _t186;
															_t91 = _t186 + 1; // 0x1
															_v88 = _t242 + _t91;
															_t188 = E10026280();
															if(_t188 == 0) {
																goto L11;
															} else {
																_t93 = _t231 + 1; // 0x1
																_v60 = _t93;
																_t224 = _t188 + _t242;
																_t243 = _v32;
																_t205 = _t224;
																_v48 = _t224;
																_v56 = _t224;
																_t225 = _a8;
																_v52 = _t243;
																if(_v60 >= 8) {
																	if((_t205 & 0x00000001) != 0) {
																		 *_v48 =  *_t243 & 0x000000ff;
																		_v60 = _t231;
																		_v56 = _v56 + 1;
																		_v52 = _v52 + 1;
																	}
																	if((_v56 & 0x00000002) != 0) {
																		_t245 = _v52;
																		_t232 = _v56;
																		 *_t232 =  *_t245 & 0x0000ffff;
																		_t138 = _t232 + 2; // 0x4
																		_v56 = _t138;
																		_v60 = _v60 - 2;
																		_v52 =  &(_t245[1]);
																	}
																	if((_v56 & 0x00000004) != 0) {
																		_t247 = _v52;
																		_t218 = _v56 + 4;
																		 *((intOrPtr*)(_t218 - 4)) =  *_t247;
																		_v56 = _t218;
																		_v60 = _v60 - 4;
																		_v52 = _t247 + 4;
																	}
																}
																_a8 = _t225;
																_v48 = _t188;
																memcpy(_v56, _v52, _v60);
																_t252 =  &(_t252[3]);
																 *_t252 =  &_v32;
																E100265C0();
																_t222 = _a8;
																_v32 = _v48;
																goto L19;
															}
														}
													}
												}
											} else {
												L11:
												_t155 = _t249;
												_t195 = 0xfffffff4;
												L12:
												if( *_t155 == 0) {
													 *_t252 =  &(_t155[1]);
													E100265C0();
													 *_t252 = _a4;
													E100265C0();
												}
												L13:
												 *_t252 = _v36;
												L100265B0();
												 *_t252 = _v32;
												L100265B0();
												return _t195;
											}
										}
									}
								}
							}
							goto L53;
						}
					}
					goto L23;
				}
				L53:
			}

0x10011d24
0x10011d27
0x10011d2d
0x10011eb0
0x10011ebb
0x10011d33
0x10011d37
0x10011d39
0x10011d3e
0x10011d49
0x10011d56
0x10011d5a
0x10011d60
0x10011d63
0x10011d68
0x00000000
0x00000000
0x10011d74
0x10011d76
0x10011d7a
0x10011d7d
0x10011d81
0x10011d8b
0x10011ec2
0x00000000
0x10011ec8
0x10011ec8
0x10011ecb
0x10011ecf
0x10011ed6
0x10011eda
0x10011ede
0x00000000
0x00000000
0x00000000
0x00000000
0x10011ede
0x10011d91
0x10011d91
0x10011d95
0x10011d97
0x10011ee4
0x10011ee4
0x10011ee6
0x00000000
0x10011d9d
0x10011d9d
0x10011d9f
0x10011da9
0x10011f30
0x10011f38
0x10011f3b
0x10011f3f
0x10011f45
0x10011f49
0x10011f4e
0x10011f52
0x10011f52
0x10011db5
0x10011f00
0x10011f03
0x10011f07
0x10011f0e
0x10011f12
0x10011f16
0x10011f18
0x00000000
0x10011f1a
0x10011f1c
0x00000000
0x10011f22
0x00000000
0x10011f22
0x10011f1c
0x10011dbb
0x10011dbb
0x10011dc1
0x10011f80
0x10011f80
0x10011f87
0x10011f8b
0x10011f90
0x10011f94
0x10011f9c
0x10011f9e
0x10011fac
0x10011fac
0x10011fae
0x10011eeb
0x10011eed
0x00000000
0x10011ef3
0x00000000
0x10011fa0
0x10011fa2
0x10011fa6
0x00000000
0x00000000
0x00000000
0x00000000
0x10011fa6
0x10011dc7
0x10011dc7
0x10011dc7
0x10011dcd
0x10011dd1
0x10011e16
0x10011fc4
0x10011fc9
0x00000000
0x10011fcb
0x10011fcb
0x10011fd5
0x10011fd9
0x10011fe0
0x10011fe3
0x10011fe8
0x10011fee
0x10011ff0
0x00000000
0x10011ff6
0x10011ff6
0x10011ff9
0x00000000
0x10011ff9
0x10011ff0
0x10011e1c
0x10011e21
0x100120f0
0x100120f3
0x100120f7
0x10012100
0x10012103
0x10012108
0x00000000
0x10011e27
0x10011e31
0x10011e34
0x10011e41
0x10011e44
0x10011e48
0x10011e4d
0x10011e51
0x10011e51
0x10011e5b
0x10011e5e
0x10011e63
0x10011e66
0x10011e69
0x10011e6d
0x10011e6d
0x10011e70
0x10011e7a
0x10011e7c
0x10011e7f
0x10011e83
0x10011e83
0x10011e89
0x10012008
0x1001200a
0x10012028
0x1001202f
0x10012032
0x1001203b
0x1001203e
0x10012043
0x10012043
0x1001200c
0x10012014
0x10012017
0x1001201c
0x10011e8f
0x10011e93
0x10011e97
0x10011e9a
0x10011e9c
0x10011e9c
0x10011e9f
0x10011ea7
0x10011eaa
0x00000000
0x00000000
0x00000000
0x00000000
0x10012050
0x10012050
0x10012053
0x10012057
0x10012060
0x10012066
0x10012069
0x10012072
0x10012075
0x10012077
0x1001207b
0x1001207f
0x10012086
0x00000000
0x1001208c
0x1001208c
0x1001208f
0x10012093
0x10012096
0x1001209f
0x100120a1
0x100120a5
0x100120a9
0x100120ad
0x100120b1
0x1001211b
0x10012157
0x10012159
0x10012162
0x1001216b
0x1001216b
0x10012122
0x10012171
0x10012175
0x1001217c
0x1001217f
0x10012182
0x10012189
0x1001218e
0x1001218e
0x10012129
0x1001212b
0x10012135
0x10012138
0x1001213b
0x10012142
0x10012147
0x10012147
0x10012129
0x100120b3
0x100120bb
0x100120c7
0x100120c7
0x100120cd
0x100120d0
0x100120d9
0x100120dd
0x00000000
0x100120dd
0x10012086
0x10011e34
0x10011e21
0x10011dd7
0x10011dd7
0x10011dd7
0x10011dd9
0x10011dde
0x10011de2
0x10011f63
0x10011f66
0x10011f6f
0x10011f72
0x10011f72
0x10011de8
0x10011dec
0x10011def
0x10011df8
0x10011dfb
0x10011e09
0x10011e09
0x10011dd1
0x10011dc1
0x10011db5
0x10011d97
0x00000000
0x10011d8b
0x10011d60
0x00000000
0x10011d5a
0x00000000

APIs

mv_strdup.MAIN ref: 10011ECF
mv_strdup.MAIN ref: 10011F07
mv_dict_get.MAIN ref: 10011F49
mv_mallocz.MAIN ref: 10011F8B

Strings

, xrefs: 10011E36

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strdup$mv_dict_getmv_mallocz
String ID:
API String ID: 3834523185-3916222277
Opcode ID: cdcb15b6093bd4b39113e05be8bf05c975e1d35020413ec04595239698647e45
Instruction ID: d18c99c6efe683f6cfe1b845026075d9942e898e7f3e9f2b0b4e4fc145e3cd38
Opcode Fuzzy Hash: cdcb15b6093bd4b39113e05be8bf05c975e1d35020413ec04595239698647e45
Instruction Fuzzy Hash: CFD1F6B4A087458FC744CF29D58055AFBE1FF88798F154A2EF8889B351E730E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004DA90 Relevance: 36.9, APIs: 11, Strings: 10, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1004DA90(intOrPtr __eax, signed int __ecx, signed int __edx) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr _v68;
				char* _v72;
				intOrPtr _t54;
				intOrPtr _t58;
				intOrPtr _t63;
				intOrPtr _t68;
				intOrPtr _t79;
				intOrPtr _t96;
				signed int _t108;
				signed int _t120;
				intOrPtr _t123;
				signed int _t130;
				intOrPtr _t139;
				void* _t145;
				intOrPtr* _t146;

				_t130 = __edx;
				_t139 = __eax;
				_t146 = _t145 - 0x3c;
				_t108 = __ecx;
				_v72 = "flags: [";
				 *_t146 = __eax;
				E100089C0();
				_v44 = _t108;
				_t120 = _t130 & 0x00000002;
				_v48 = _t130 & 0x00000001;
				_v40 = _t108 & 0x10000000;
				_v36 = _t108 & 0x08000000;
				if((_t108 & 0x40000000) != 0) {
					 *_t146 = _t139;
					_v72 = "aligned";
					_v32 = _t120;
					E100089C0();
					if(_v32 != 0) {
						_t54 = 0x100bcb00;
						goto L3;
					} else {
						if(_v48 != 0) {
							goto L4;
						} else {
							goto L30;
						}
					}
				} else {
					if(_t120 == 0) {
						if(_v48 != 0) {
							_t96 = 0x100bcb03;
							goto L5;
						} else {
							if(_v44 < 0) {
								_t58 = 0x100bcb03;
								goto L38;
							} else {
								if(_v36 != 0) {
									_t63 = 0x100bcb03;
									goto L8;
								} else {
									if(_v40 == 0) {
										_t79 = 0x100bcb03;
										if((_t108 & 0x20000000) != 0) {
											goto L24;
										} else {
											if((_t130 & 0x00000004) != 0) {
												goto L13;
											} else {
												_t123 = 0x100bcb03;
												if((_t108 & 0x04000000) != 0) {
													goto L27;
												} else {
												}
											}
										}
									} else {
										_t68 = 0x100bcb03;
										goto L22;
									}
								}
							}
						}
					} else {
						_t54 = 0x100bcb03;
						L3:
						_v68 = _t54;
						_v72 = "%sunaligned";
						 *_t146 = _t139;
						E100089C0();
						if(_v48 == 0) {
							L30:
							if(_v44 < 0) {
								goto L43;
							} else {
								if(_v36 != 0) {
									goto L7;
								} else {
									if(_v40 != 0) {
										goto L21;
									} else {
										if((_t108 & 0x20000000) != 0) {
											goto L23;
										} else {
											goto L11;
										}
									}
								}
							}
						} else {
							L4:
							_t96 = 0x100bcb00;
							L5:
							_v68 = _t96;
							_v72 = "%sinplace";
							 *_t146 = _t139;
							E100089C0();
							if(_v44 < 0) {
								L43:
								_t58 = 0x100bcb00;
								L38:
								_v68 = _t58;
								_v72 = "%sout_of_place";
								 *_t146 = _t139;
								E100089C0();
								if(_v36 != 0) {
									goto L7;
								} else {
									if(_v40 != 0) {
										goto L21;
									} else {
										if((_t108 & 0x20000000) != 0) {
											goto L23;
										} else {
											if((_t130 & 0x00000004) == 0) {
												goto L14;
											} else {
												goto L12;
											}
											L49:
										}
									}
								}
							} else {
								if(_v36 != 0) {
									L7:
									_t63 = 0x100bcb00;
									L8:
									_v68 = _t63;
									_v72 = "%sfwd_only";
									 *_t146 = _t139;
									E100089C0();
								}
								if(_v40 != 0) {
									L21:
									_t68 = 0x100bcb00;
									L22:
									_v68 = _t68;
									_v72 = "%sinv_only";
									 *_t146 = _t139;
									E100089C0();
									if((_t108 & 0x20000000) == 0) {
										goto L11;
									} else {
										goto L23;
									}
								} else {
									if((_t108 & 0x20000000) != 0) {
										L23:
										_t79 = 0x100bcb00;
										L24:
										_v68 = _t79;
										_v72 = "%spreshuf";
										 *_t146 = _t139;
										E100089C0();
										if((_t130 & 0x00000004) != 0) {
											goto L12;
										} else {
											if((_t108 & 0x04000000) != 0) {
												goto L26;
											}
										}
									} else {
										L11:
										if((_t130 & 0x00000004) != 0) {
											L12:
											L13:
											_v68 = 0x100bcb00;
											_v72 = "%simdct_full";
											 *_t146 = _t139;
											E100089C0();
										}
										L14:
										if((_t108 & 0x04000000) != 0) {
											L26:
											_t123 = 0x100bcb00;
											L27:
											_v68 = _t123;
											_v72 = "%sasm_call";
											 *_t146 = _t139;
											E100089C0();
										}
									}
								}
							}
						}
					}
				}
				 *_t146 = _t139;
				_v72 = 0x100bcb72;
				return E100089C0();
				goto L49;
			}

0x1004da94
0x1004da97
0x1004da9f
0x1004daa2
0x1004daa4
0x1004daa8
0x1004daab
0x1004dab4
0x1004dabb
0x1004dabe
0x1004dac9
0x1004dad4
0x1004dae2
0x1004dc90
0x1004dc98
0x1004dc9c
0x1004dca0
0x1004dcad
0x1004dd08
0x00000000
0x1004dcaf
0x1004dcb3
0x00000000
0x00000000
0x00000000
0x00000000
0x1004dcb3
0x1004dae8
0x1004daec
0x1004dbd4
0x1004dcf8
0x00000000
0x1004dbda
0x1004dbe0
0x1004dd18
0x00000000
0x1004dbe6
0x1004dbed
0x1004dd80
0x00000000
0x1004dbf3
0x1004dbfa
0x1004dd8c
0x1004dd9a
0x00000000
0x1004dda0
0x1004dda6
0x00000000
0x1004ddac
0x1004ddae
0x1004ddbb
0x00000000
0x00000000
0x1004ddc1
0x1004ddbb
0x1004dda6
0x1004dc00
0x1004dc00
0x00000000
0x1004dc00
0x1004dbfa
0x1004dbed
0x1004dbe0
0x1004daf2
0x1004daf2
0x1004daf7
0x1004daf7
0x1004db00
0x1004db04
0x1004db07
0x1004db10
0x1004dcb9
0x1004dcbf
0x00000000
0x1004dcc5
0x1004dccc
0x00000000
0x1004dcd2
0x1004dcd9
0x00000000
0x1004dcdf
0x1004dce9
0x00000000
0x1004dcef
0x00000000
0x1004dcef
0x1004dce9
0x1004dcd9
0x1004dccc
0x1004db16
0x1004db16
0x1004db16
0x1004db1b
0x1004db1b
0x1004db24
0x1004db28
0x1004db2b
0x1004db36
0x1004dd70
0x1004dd70
0x1004dd1d
0x1004dd1d
0x1004dd26
0x1004dd2a
0x1004dd2d
0x1004dd39
0x00000000
0x1004dd3f
0x1004dd46
0x00000000
0x1004dd4c
0x1004dd56
0x00000000
0x1004dd5c
0x1004dd62
0x00000000
0x1004dd68
0x00000000
0x1004dd68
0x00000000
0x1004dd62
0x1004dd56
0x1004dd46
0x1004db3c
0x1004db43
0x1004db45
0x1004db45
0x1004db4a
0x1004db4a
0x1004db53
0x1004db57
0x1004db5a
0x1004db5a
0x1004db66
0x1004dc10
0x1004dc10
0x1004dc15
0x1004dc15
0x1004dc1e
0x1004dc22
0x1004dc25
0x1004dc34
0x00000000
0x00000000
0x00000000
0x00000000
0x1004db6c
0x1004db76
0x1004dc3a
0x1004dc3a
0x1004dc3f
0x1004dc3f
0x1004dc4b
0x1004dc4f
0x1004dc52
0x1004dc5a
0x00000000
0x1004dc60
0x1004dc69
0x00000000
0x00000000
0x1004dc69
0x1004db7c
0x1004db7c
0x1004db82
0x1004db84
0x1004db89
0x1004db89
0x1004db92
0x1004db96
0x1004db99
0x1004db99
0x1004db9e
0x1004dba7
0x1004dc6f
0x1004dc6f
0x1004dc74
0x1004dc74
0x1004dc7d
0x1004dc81
0x1004dc84
0x1004dc84
0x1004dba7
0x1004db76
0x1004db66
0x1004db36
0x1004db10
0x1004daec
0x1004dbad
0x1004dbb5
0x1004dbc5
0x00000000

APIs

mv_bprintf.MAIN ref: 1004DAAB
mv_bprintf.MAIN ref: 1004DB07
mv_bprintf.MAIN ref: 1004DB2B
mv_bprintf.MAIN ref: 1004DB5A
mv_bprintf.MAIN ref: 1004DB99
mv_bprintf.MAIN ref: 1004DBB9
mv_bprintf.MAIN ref: 1004DC25
mv_bprintf.MAIN ref: 1004DC52
mv_bprintf.MAIN ref: 1004DC84
mv_bprintf.MAIN ref: 1004DCA0
mv_bprintf.MAIN ref: 1004DD2D

Strings

%sasm_call, xrefs: 1004DC78
flags: [, xrefs: 1004DA9A
aligned, xrefs: 1004DC93
%spreshuf, xrefs: 1004DC43
%sunaligned, xrefs: 1004DAFB
%sfwd_only, xrefs: 1004DB4E
%simdct_full, xrefs: 1004DB8D
%sinplace, xrefs: 1004DB1F
%sout_of_place, xrefs: 1004DD21
%sinv_only, xrefs: 1004DC19

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %sasm_call$%sfwd_only$%simdct_full$%sinplace$%sinv_only$%sout_of_place$%spreshuf$%sunaligned$aligned$flags: [
API String ID: 3083893021-1441846183
Opcode ID: 16923d63af30e83d2c7efbf8c1da79df8fe88a9a1f2f24f8342d05ec943732c7
Instruction ID: 1dc6e91ea481e811bfe5c5906a416067f5532a53e96b106321926297a6af6804
Opcode Fuzzy Hash: 16923d63af30e83d2c7efbf8c1da79df8fe88a9a1f2f24f8342d05ec943732c7
Instruction Fuzzy Hash: DD6110B5A186858BE300EF19C492B1FBAD1EB84794F66883EF0C8C7240D778DD41D78A

Uniqueness

Uniqueness Score: -1.00%

Function 100296D4 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 221COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 100296DC
mv_freep.MAIN ref: 100296E8
mv_freep.MAIN ref: 10029721
mv_freep.MAIN ref: 1002972D
mv_log.MAIN ref: 1002977B

Strings

%-15s , xrefs: 100292D4
"%s", xrefs: 100297AF
%lld, xrefs: 10029876
%d/%d, xrefs: 10029A8B
(default , xrefs: 10029762

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_log
String ID: %-15s $ (default $"%s"$%d/%d$%lld
API String ID: 2749705325-3616743394
Opcode ID: 29b06a4c8fc90e14002c87a4c6f33f06bcf76f627d83655d7f8131f9e1fae942
Instruction ID: a78736eaf865b939ee6902c1b70fed4f9ad85332988bb7fcaf3499c0514d5393
Opcode Fuzzy Hash: 29b06a4c8fc90e14002c87a4c6f33f06bcf76f627d83655d7f8131f9e1fae942
Instruction Fuzzy Hash: D191AF78A087459FC750DF28E48065EFBE1FF89780F91892EF8998B351E774E9418B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002E900 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 199stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1002E948
mv_strlcpy.MAIN ref: 1002E96B
strchr.MSVCRT ref: 1002E97C
strlen.MSVCRT ref: 1002E996
mv_strcasecmp.MAIN ref: 1002E9AF
mv_strcasecmp.MAIN ref: 1002E9C4
mv_get_random_seed.MAIN ref: 1002E9D1
strtoul.MSVCRT ref: 1002EA06

Strings

Invalid 0xRRGGBB[AA] color string: '%s', xrefs: 1002EBF7
random, xrefs: 1002E9A6
0123456789ABCDEFabcdef, xrefs: 1002EACB
bikeshed, xrefs: 1002E9BB
Invalid alpha value specifier '%s' in '%s', xrefs: 1002EBC4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strcasecmpstrlen$mv_get_random_seedmv_strlcpystrchrstrtoul
String ID: 0123456789ABCDEFabcdef$Invalid 0xRRGGBB[AA] color string: '%s'$Invalid alpha value specifier '%s' in '%s'$bikeshed$random
API String ID: 887406882-1143575717
Opcode ID: 7860c4bc397d7a84b5ba2d4e37a997edbae9552f042c2e5f1cc318da8c30d779
Instruction ID: 5528a354f5a3b115f7f47ff1570fdc362057e49d17d9d5bd6ab876f37a57e2b2
Opcode Fuzzy Hash: 7860c4bc397d7a84b5ba2d4e37a997edbae9552f042c2e5f1cc318da8c30d779
Instruction Fuzzy Hash: 5F819A749487819ED342DF38D49064EBBE0EF85380F95CE6EE8C99B241E778D980DB42

Uniqueness

Uniqueness Score: -1.00%

Function 10011210 Relevance: 30.2, APIs: 20, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E10011210(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr __ebp, signed int _a4, signed int _a8, void* _a12, signed int _a16) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v32;
				void* _v36;
				int _v48;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _t94;
				signed int* _t95;
				signed int _t101;
				signed int _t102;
				signed int _t104;
				signed int _t106;
				int _t108;
				int _t109;
				int _t111;
				signed int* _t118;
				int _t122;
				signed int _t123;
				int _t126;
				signed int _t127;
				signed int* _t130;
				int _t133;
				signed int _t134;
				void _t136;
				signed int _t138;
				void* _t142;
				signed int _t146;
				void* _t147;
				signed int _t149;
				signed int _t150;
				int _t153;
				void* _t154;
				signed int* _t157;
				signed int* _t158;

				_v8 = __edi;
				_v16 = __ebx;
				_t138 = _a16;
				_v12 = __esi;
				_t146 = _a8;
				_v4 = __ebp;
				_t118 =  *_a4;
				_v36 = 0;
				_v32 = 0;
				if((_t138 & 0x00000008) == 0) {
					if(_a12 == 0) {
						goto L2;
					}
					 *_t158 = _a12;
					_v32 = E100267C0(_t118, _t138, _t146, __ebp);
					if(_t146 != 0) {
						goto L3;
					}
					goto L22;
				} else {
					_v32 = _a12;
					L2:
					if(_t146 == 0) {
						L22:
						_t147 = 0xffffffea;
						L23:
						if(_t118 == 0) {
							L10:
							 *_t158 = _v36;
							L100265B0();
							 *_t158 = _v32;
							L100265B0();
							L11:
							return _t147;
						}
						L9:
						if( *_t118 == 0) {
							 *_t158 =  &(_t118[1]);
							E100265C0();
							 *_t158 = _a4;
							E100265C0();
						}
						goto L10;
					}
					L3:
					_t157 = 0;
					if((_t138 & 0x00000040) == 0) {
						_v64 = _t138;
						_v68 = 0;
						_v72 = _t146;
						 *_t158 = _t118;
						_t157 = E100110D0();
					}
					if((_t138 & 0x00000004) == 0) {
						 *_t158 = _t146;
						_t94 = E100267C0(_t118, _t138, _t146, _t157);
						_v36 = _t94;
						_t149 = _t94;
						if(_t118 == 0) {
							goto L29;
						}
						if(_t94 == 0) {
							goto L8;
						}
						goto L6;
					} else {
						_v36 = _t146;
						if(_t118 == 0) {
							L29:
							 *_t158 = 8;
							_t95 = E100265E0();
							_t149 = _v36;
							_t118 = _t95;
							 *_a4 = _t118;
							if(_t118 == 0 || _t149 == 0) {
								_t147 = 0xfffffff4;
								goto L23;
							} else {
								goto L6;
							}
						}
						L6:
						_t122 = _v32;
						if(_a12 == 0 || _t122 != 0) {
							if(_t157 == 0) {
								_t150 =  *_t118;
								if(_t122 == 0) {
									L37:
									if(_t150 == 0) {
										 *_t158 =  &(_t118[1]);
										E100265C0();
										 *_t158 = _a4;
										E100265C0();
									}
									_t147 = 0;
									 *_t158 =  &_v36;
									E100265C0();
									goto L11;
								}
								_v68 = 8;
								_v72 = _t150 + 1;
								 *_t158 = _t118[1];
								_t101 = E100264F0();
								_t123 = _t101;
								if(_t101 == 0) {
									goto L8;
								}
								_t118[1] = _t101;
								_t150 =  *_t118;
								L18:
								_t102 = _v32;
								if(_t102 == 0) {
									goto L37;
								}
								_t130 = _t123 + _t150 * 8;
								_t130[1] = _t102;
								 *_t130 = _v36;
								 *_t118 = _t150 + 1;
								_t147 = 0;
								goto L11;
							}
							if((_t138 & 0x00000010) != 0) {
								 *_t158 = _t149;
								_t147 = 0;
								L100265B0();
								 *_t158 = _v32;
								L100265B0();
								goto L11;
							}
							_t104 = _a4;
							if(_t122 == 0 || (_t138 & 0x00000020) == 0) {
								 *_t158 = _t104;
								L100265B0();
								goto L17;
							} else {
								 *_t158 = _t104;
								_v48 = _t122;
								_t108 = strlen(??);
								 *_t158 = _v48;
								_t153 = _t108;
								_t109 = strlen(??);
								 *_t158 = _t104;
								_v48 = _t109;
								_t63 = _t109 + 1; // 0x1
								_v72 = _t153 + _t63;
								_t111 = E10026280();
								if(_t111 == 0) {
									goto L8;
								}
								_t133 = _v48;
								_t142 = _t111 + _t153;
								_t154 = _v32;
								_t126 = _t133 + 1;
								if(_t126 >= 8) {
									if((_t142 & 0x00000001) != 0) {
										_t127 =  *_t154 & 0x000000ff;
										_t142 = _t142 + 1;
										_t154 = _t154 + 1;
										 *(_t142 - 1) = _t127;
										_t126 = _t133;
									}
									if((_t142 & 0x00000002) != 0) {
										_t134 =  *_t154 & 0x0000ffff;
										_t142 = _t142 + 2;
										_t154 = _t154 + 2;
										_t126 = _t126 - 2;
										 *(_t142 - 2) = _t134;
									}
									if((_t142 & 0x00000004) != 0) {
										_t136 =  *_t154;
										_t142 = _t142 + 4;
										_t154 = _t154 + 4;
										_t126 = _t126 - 4;
										 *(_t142 - 4) = _t136;
									}
								}
								_v48 = _t111;
								memcpy(_t142, _t154, _t126);
								_t158 =  &(_t158[3]);
								 *_t158 =  &_v32;
								E100265C0();
								_v32 = _v48;
								L17:
								 *_t158 =  *_t157;
								L100265B0();
								_t106 =  *_t118;
								_t123 = _t118[1];
								_t31 = _t106 - 1; // -1
								_t150 = _t31;
								 *_t118 = _t150;
								 *_t157 =  *(_t123 + _t150 * 8);
								_a4 =  *(_t123 + 4 + _t150 * 8);
								goto L18;
							}
						} else {
							L8:
							_t147 = 0xfffffff4;
							goto L9;
						}
					}
				}
			}

0x10011213
0x1001121b
0x1001121f
0x10011223
0x10011227
0x1001122b
0x1001122f
0x10011233
0x1001123f
0x10011243
0x10011346
0x00000000
0x00000000
0x10011350
0x1001135a
0x1001135e
0x00000000
0x00000000
0x00000000
0x10011249
0x1001124d
0x10011251
0x10011253
0x10011364
0x10011364
0x10011369
0x1001136b
0x1001129e
0x100112a2
0x100112a5
0x100112ae
0x100112b1
0x100112b6
0x100112cb
0x100112cb
0x10011294
0x10011298
0x10011413
0x10011416
0x1001141f
0x10011422
0x10011422
0x00000000
0x10011298
0x10011259
0x10011259
0x10011261
0x100113a0
0x100113a6
0x100113aa
0x100113ae
0x100113b6
0x100113b6
0x1001126d
0x10011380
0x10011383
0x1001138a
0x1001138e
0x10011390
0x00000000
0x00000000
0x10011394
0x00000000
0x00000000
0x00000000
0x10011273
0x10011273
0x10011279
0x100113c0
0x100113c0
0x100113c7
0x100113cc
0x100113d0
0x100113d8
0x100113da
0x100113e4
0x00000000
0x00000000
0x00000000
0x00000000
0x100113da
0x1001127f
0x10011283
0x10011289
0x100112d2
0x10011432
0x10011434
0x10011468
0x1001146a
0x100114fb
0x100114fe
0x10011507
0x1001150a
0x1001150a
0x10011474
0x10011476
0x10011479
0x00000000
0x10011479
0x1001143c
0x10011440
0x10011447
0x1001144a
0x10011451
0x10011453
0x00000000
0x00000000
0x10011459
0x1001145c
0x1001131e
0x1001131e
0x10011324
0x00000000
0x00000000
0x1001132a
0x10011332
0x10011335
0x10011337
0x10011339
0x00000000
0x10011339
0x100112de
0x100113f0
0x100113f3
0x100113f5
0x100113fe
0x10011401
0x00000000
0x10011401
0x100112e6
0x100112e9
0x100112f4
0x100112f7
0x00000000
0x10011488
0x10011488
0x1001148d
0x10011491
0x1001149a
0x1001149d
0x1001149f
0x100114a4
0x100114a9
0x100114ad
0x100114b1
0x100114b5
0x100114bc
0x00000000
0x00000000
0x100114c2
0x100114c6
0x100114c9
0x100114cd
0x100114d3
0x1001151e
0x10011540
0x10011543
0x10011544
0x10011545
0x10011548
0x10011548
0x10011526
0x1001154c
0x1001154f
0x10011552
0x10011555
0x10011558
0x10011558
0x1001152e
0x10011530
0x10011532
0x10011535
0x10011538
0x1001153b
0x1001153b
0x1001152e
0x100114d5
0x100114dd
0x100114dd
0x100114df
0x100114e2
0x100114eb
0x100112fc
0x100112ff
0x10011302
0x10011307
0x10011309
0x1001130c
0x1001130c
0x1001130f
0x10011318
0x1001131b
0x00000000
0x1001131b
0x1001128f
0x1001128f
0x1001128f
0x00000000
0x1001128f
0x10011289
0x1001126d

APIs

mv_strdup.MAIN ref: 10011353
mv_strdup.MAIN ref: 10011383
mv_dict_get.MAIN ref: 100113B1
mv_mallocz.MAIN ref: 100113C7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strdup$mv_dict_getmv_mallocz
String ID:
API String ID: 3834523185-0
Opcode ID: 34b8535691b7a7fadd794d32cbd0790fd03931f9f00ffb340a5a63087569dce7
Instruction ID: 095bdf82c674aaefaf2cda3429f550f943fa4cc151a1ce18d08b383c11ff4614
Opcode Fuzzy Hash: 34b8535691b7a7fadd794d32cbd0790fd03931f9f00ffb340a5a63087569dce7
Instruction Fuzzy Hash: F39127B5A087518FC754DF68C48065EBBE1FF88794F12892DED989B344E770E981CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001A6C0 Relevance: 28.8, APIs: 19, Instructions: 325
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E1001A6C0(void* __eax, void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t251;
				signed int _t259;
				void* _t262;
				signed int* _t263;
				void* _t264;
				void* _t269;
				signed int _t275;
				void* _t278;
				signed int _t290;
				signed int _t291;
				void _t293;
				void* _t294;
				signed int _t307;
				signed int _t308;
				int _t311;
				signed int _t315;
				int _t321;
				void* _t323;
				int _t324;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t333;
				signed int _t335;
				void _t337;
				void* _t338;
				signed char* _t340;
				void* _t341;
				signed short* _t342;
				void _t343;
				signed int _t344;
				void* _t345;
				void* _t346;
				void** _t347;

				_t345 = __eax;
				_t347 = _t346 - 0x4c;
				_t347[8] = __ecx;
				 *((intOrPtr*)(__eax + 0x54)) =  *((intOrPtr*)(__edx + 0x54));
				 *((intOrPtr*)(__eax + 0x5c)) =  *((intOrPtr*)(__edx + 0x5c));
				 *((intOrPtr*)(__eax + 0x60)) =  *((intOrPtr*)(__edx + 0x60));
				 *((intOrPtr*)(__eax + 0x58)) =  *((intOrPtr*)(__edx + 0x58));
				 *((intOrPtr*)(__eax + 0x130)) =  *((intOrPtr*)(__edx + 0x130));
				 *((intOrPtr*)(__eax + 0x134)) =  *((intOrPtr*)(__edx + 0x134));
				 *((intOrPtr*)(__eax + 0x138)) =  *((intOrPtr*)(__edx + 0x138));
				 *((intOrPtr*)(__eax + 0x68)) =  *((intOrPtr*)(__edx + 0x68));
				 *((intOrPtr*)(__eax + 0x6c)) =  *((intOrPtr*)(__edx + 0x6c));
				 *((intOrPtr*)(__eax + 0x13c)) =  *((intOrPtr*)(__edx + 0x13c));
				 *((intOrPtr*)(__eax + 0x170)) =  *((intOrPtr*)(__edx + 0x170));
				 *((intOrPtr*)(__eax + 0x174)) =  *((intOrPtr*)(__edx + 0x174));
				 *((intOrPtr*)(__eax + 0x90)) =  *((intOrPtr*)(__edx + 0x90));
				 *((intOrPtr*)(__eax + 0x94)) =  *((intOrPtr*)(__edx + 0x94));
				 *((intOrPtr*)(__eax + 0x98)) =  *((intOrPtr*)(__edx + 0x98));
				 *((intOrPtr*)(__eax + 0x9c)) =  *((intOrPtr*)(__edx + 0x9c));
				 *((intOrPtr*)(__eax + 0xa8)) =  *((intOrPtr*)(__edx + 0xa8));
				 *((intOrPtr*)(__eax + 0x70)) =  *((intOrPtr*)(__edx + 0x70));
				 *((intOrPtr*)(__eax + 0x74)) =  *((intOrPtr*)(__edx + 0x74));
				 *((intOrPtr*)(__eax + 0x8c)) =  *((intOrPtr*)(__edx + 0x8c));
				 *((intOrPtr*)(__eax + 0x108)) =  *((intOrPtr*)(__edx + 0x108));
				 *((intOrPtr*)(__eax + 0x10c)) =  *((intOrPtr*)(__edx + 0x10c));
				 *((intOrPtr*)(__eax + 0x124)) =  *((intOrPtr*)(__edx + 0x124));
				 *((intOrPtr*)(__eax + 0x110)) =  *((intOrPtr*)(__edx + 0x110));
				 *((intOrPtr*)(__eax + 0x114)) =  *((intOrPtr*)(__edx + 0x114));
				 *((intOrPtr*)(__eax + 0x78)) =  *((intOrPtr*)(__edx + 0x78));
				 *((intOrPtr*)(__eax + 0x7c)) =  *((intOrPtr*)(__edx + 0x7c));
				 *((intOrPtr*)(__eax + 0xa0)) =  *((intOrPtr*)(__edx + 0xa0));
				 *((intOrPtr*)(__eax + 0xa4)) =  *((intOrPtr*)(__edx + 0xa4));
				_t347[6] = __edx;
				_t304 =  *(__edx + 0x100);
				_t289 =  *(__edx + 0x104);
				 *((intOrPtr*)(__eax + 0x88)) =  *((intOrPtr*)(__edx + 0x88));
				 *(__eax + 0x100) =  *(__edx + 0x100);
				 *(__eax + 0x104) =  *(__edx + 0x104);
				 *((intOrPtr*)(__eax + 0x80)) =  *((intOrPtr*)(__edx + 0x80));
				 *((intOrPtr*)(__eax + 0x84)) =  *((intOrPtr*)(__edx + 0x84));
				 *((intOrPtr*)(__eax + 0xe8)) =  *((intOrPtr*)(__edx + 0xe8));
				 *((intOrPtr*)(__eax + 0x11c)) =  *((intOrPtr*)(__edx + 0x11c));
				 *((intOrPtr*)(__eax + 0xf0)) =  *((intOrPtr*)(__edx + 0xf0));
				 *((intOrPtr*)(__eax + 0xf4)) =  *((intOrPtr*)(__edx + 0xf4));
				 *((intOrPtr*)(__eax + 0xf8)) =  *((intOrPtr*)(__edx + 0xf8));
				 *((intOrPtr*)(__eax + 0xec)) =  *((intOrPtr*)(__edx + 0xec));
				 *((intOrPtr*)(__eax + 0xfc)) =  *((intOrPtr*)(__edx + 0xfc));
				_t347[2] = 0;
				_t347[1] =  *(__edx + 0x118);
				 *_t347 = __eax + 0x118;
				E10011D20();
				_t321 = _t347[6];
				if( *((intOrPtr*)(_t321 + 0xe4)) <= 0) {
					L31:
					_t347[6] = _t321;
					_t347[1] =  *(_t321 + 0x12c);
					 *_t347 = _t345 + 0x12c;
					_t290 = E1000A480(_t289, _t326, _t334, _t345);
					_t347[1] =  *(_t347[6] + 0x140);
					 *_t347 = _t345 + 0x140;
					return E1000A480(_t290, _t326, _t334, _t345) | _t290;
				} else {
					_t347[6] = 0;
					do {
						_t334 = _t347[6];
						_t289 =  *( *((intOrPtr*)(_t321 + 0xe0)) + _t347[6] * 4);
						_t326 =  *_t289;
						if(_t326 != 0 ||  *((intOrPtr*)(_t321 + 0x44)) ==  *((intOrPtr*)(_t345 + 0x44)) &&  *((intOrPtr*)(_t321 + 0x48)) ==  *((intOrPtr*)(_t345 + 0x48))) {
							if(_t347[8] != 0) {
								_t347[0xa] = _t321;
								 *_t347 =  *(_t289 + 8);
								_t251 = L10009DC0(_t289, _t304, _t326, _t334);
								_t347[0xf] = _t251;
								_t335 = _t251;
								if(_t251 == 0) {
									L19:
									 *_t347 =  &(_t347[0xf]);
									E1000A000(_t289, _t335);
									if( *(_t345 + 0xe4) > 0) {
										_t291 = 0;
										do {
											_t327 =  *(_t345 + 0xe0) + _t291 * 4;
											_t291 = _t291 + 1;
											_t337 =  *_t327;
											_t338 = _t337 + 0xc;
											 *_t347 = _t337 + 0x10;
											E1000A000(_t291, _t338);
											 *_t347 = _t338;
											E10011CC0();
											 *_t347 = _t327;
											E100265C0();
										} while (_t291 <  *(_t345 + 0xe4));
									}
									goto L22;
								} else {
									_t259 =  *(_t345 + 0xe4);
									if(_t259 > 0x1ffffffe) {
										goto L19;
									} else {
										_t347[1] = 4 + _t259 * 4;
										 *_t347 =  *(_t345 + 0xe0);
										_t262 = E10026280();
										if(_t262 == 0) {
											goto L19;
										} else {
											 *(_t345 + 0xe0) = _t262;
											 *_t347 = 0x14;
											_t263 = E100265E0();
											if(_t263 == 0) {
												goto L19;
											} else {
												_t263[4] = _t335;
												_t323 =  *(_t335 + 4);
												 *_t263 = _t326;
												_t263[2] =  *(_t335 + 8);
												_t307 =  *(_t345 + 0xe4);
												_t263[1] = _t323;
												_t347[0xb] = _t323;
												 *(_t345 + 0xe4) = _t307 + 1;
												 *( *(_t345 + 0xe0) + _t307 * 4) = _t263;
												_t340 =  *(_t289 + 4);
												_t347[7] =  *(_t289 + 8);
												_t330 = _t323;
												_t324 = _t347[0xa];
												_t347[9] = _t340;
												if(_t347[7] >= 8) {
													if((_t330 & 0x00000001) != 0) {
														_t308 =  *_t340 & 0x000000ff;
														_t330 = _t330 + 1;
														_t347[0xa] = _t308;
														 *(_t330 - 1) = _t308;
														_t347[7] = _t347[7] - 1;
														_t347[9] = _t347[9] + 1;
														if((_t330 & 0x00000002) != 0) {
															goto L34;
														}
													} else {
														if((_t330 & 0x00000002) != 0) {
															L34:
															_t342 = _t347[9];
															_t330 = _t330 + 2;
															 *((short*)(_t330 - 2)) =  *_t342 & 0x0000ffff;
															_t347[7] = _t347[7] - 2;
															_t347[9] =  &(_t342[1]);
														}
													}
													if((_t330 & 0x00000004) != 0) {
														_t341 = _t347[9];
														_t330 = _t330 + 4;
														 *(_t330 - 4) =  *_t341;
														_t347[7] = _t347[7] - 4;
														_t347[9] = _t341 + 4;
													}
												}
												_t334 = _t347[9];
												_t311 = _t347[7];
												_t264 = memcpy(_t330, _t334, _t311);
												_t347 =  &(_t347[3]);
												_t326 = _t334 + _t311 + _t311;
												goto L8;
											}
										}
									}
								}
							} else {
								_t347[7] = _t321;
								 *_t347 =  *(_t289 + 0x10);
								_t269 = L10009FC0(_t289, _t304);
								_t343 =  *_t289;
								_t347[0xf] = _t269;
								_t332 = _t269;
								if(_t269 == 0) {
									L23:
									 *_t347 =  &(_t347[0xf]);
									E1000A000(_t289, _t343);
									if( *(_t345 + 0xe4) > 0) {
										_t344 = _t347[8];
										do {
											_t333 =  *(_t345 + 0xe0) + _t344 * 4;
											_t344 = _t344 + 1;
											_t293 =  *_t333;
											_t294 = _t293 + 0xc;
											 *_t347 = _t293 + 0x10;
											E1000A000(_t294, _t344);
											 *_t347 = _t294;
											E10011CC0();
											 *_t347 = _t333;
											E100265C0();
										} while (_t344 <  *(_t345 + 0xe4));
									}
									L22:
									 *(_t345 + 0xe4) = 0;
									 *_t347 = _t345 + 0xe0;
									E100265C0();
									return 0xfffffff4;
								} else {
									_t275 =  *(_t345 + 0xe4);
									if(_t275 > 0x1ffffffe) {
										goto L23;
									} else {
										_t347[1] = 4 + _t275 * 4;
										 *_t347 =  *(_t345 + 0xe0);
										_t278 = E10026280();
										if(_t278 == 0) {
											goto L23;
										} else {
											 *(_t345 + 0xe0) = _t278;
											 *_t347 = 0x14;
											_t264 = E100265E0();
											if(_t264 == 0) {
												goto L23;
											} else {
												 *(_t264 + 0x10) = _t332;
												_t324 = _t347[7];
												 *((intOrPtr*)(_t264 + 4)) =  *((intOrPtr*)(_t332 + 4));
												 *_t264 = _t343;
												_t334 =  *(_t345 + 0xe0);
												 *((intOrPtr*)(_t264 + 8)) =  *((intOrPtr*)(_t332 + 8));
												_t315 =  *(_t345 + 0xe4);
												_t326 = _t315 + 1;
												 *(_t345 + 0xe4) = _t315 + 1;
												 *( *(_t345 + 0xe0) + _t315 * 4) = _t264;
												L8:
												_t347[7] = _t324;
												_t347[2] = 0;
												_t304 =  *(_t289 + 0xc);
												 *_t347 = _t264 + 0xc;
												_t347[1] =  *(_t289 + 0xc);
												E10011D20();
												_t321 = _t347[7];
												goto L9;
											}
										}
									}
								}
							}
						} else {
							goto L9;
						}
						goto L35;
						L9:
						_t347[6] = _t347[6] + 1;
					} while ( *((intOrPtr*)(_t321 + 0xe4)) > _t347[6]);
					goto L31;
				}
				L35:
			}

0x1001a6c1
0x1001a6c6
0x1001a6c9
0x1001a6d6
0x1001a6dc
0x1001a6e2
0x1001a6e8
0x1001a6f1
0x1001a6fd
0x1001a709
0x1001a715
0x1001a71e
0x1001a727
0x1001a733
0x1001a739
0x1001a73f
0x1001a751
0x1001a75d
0x1001a769
0x1001a775
0x1001a781
0x1001a78a
0x1001a793
0x1001a79f
0x1001a7ab
0x1001a7b7
0x1001a7bd
0x1001a7c6
0x1001a7cf
0x1001a7d8
0x1001a7e1
0x1001a7e7
0x1001a7f3
0x1001a7f7
0x1001a7fd
0x1001a803
0x1001a80f
0x1001a815
0x1001a81b
0x1001a827
0x1001a833
0x1001a83f
0x1001a84b
0x1001a857
0x1001a863
0x1001a86f
0x1001a87b
0x1001a883
0x1001a88d
0x1001a897
0x1001a89a
0x1001a89f
0x1001a8ab
0x1001ab88
0x1001ab88
0x1001ab92
0x1001ab9c
0x1001aba8
0x1001abb0
0x1001abba
0x1001abcb
0x1001a8b1
0x1001a8b3
0x1001a9b3
0x1001a9b9
0x1001a9bd
0x1001a9c0
0x1001a9c4
0x1001a9dc
0x1001a8c0
0x1001a8c7
0x1001a8ca
0x1001a8cf
0x1001a8d5
0x1001a8d7
0x1001aa80
0x1001aa84
0x1001aa87
0x1001aa94
0x1001aa96
0x1001aa98
0x1001aa9e
0x1001aaa1
0x1001aaa2
0x1001aaa7
0x1001aaaa
0x1001aaad
0x1001aab2
0x1001aab5
0x1001aaba
0x1001aabd
0x1001aac2
0x1001aa98
0x00000000
0x1001a8dd
0x1001a8dd
0x1001a8e8
0x00000000
0x1001a8ee
0x1001a8f5
0x1001a8ff
0x1001a902
0x1001a909
0x00000000
0x1001a90f
0x1001a90f
0x1001a915
0x1001a91c
0x1001a923
0x00000000
0x1001a929
0x1001a929
0x1001a92f
0x1001a932
0x1001a93a
0x1001a93d
0x1001a943
0x1001a946
0x1001a94d
0x1001a956
0x1001a959
0x1001a95c
0x1001a960
0x1001a962
0x1001a96b
0x1001a96f
0x1001ab46
0x1001abd0
0x1001abd3
0x1001abd4
0x1001abd8
0x1001abdf
0x1001abea
0x1001abee
0x00000000
0x00000000
0x1001ab4c
0x1001ab52
0x1001ac00
0x1001ac00
0x1001ac04
0x1001ac0a
0x1001ac11
0x1001ac16
0x1001ac16
0x1001ab52
0x1001ab5e
0x1001ab64
0x1001ab68
0x1001ab6d
0x1001ab73
0x1001ab78
0x1001ab78
0x1001ab5e
0x1001a975
0x1001a979
0x1001a97d
0x1001a97d
0x1001a97d
0x00000000
0x1001a97d
0x1001a923
0x1001a909
0x1001a8e8
0x1001a9e2
0x1001a9e2
0x1001a9e9
0x1001a9ec
0x1001a9f1
0x1001a9f3
0x1001a9f9
0x1001a9fb
0x1001aaf0
0x1001aaf4
0x1001aaf7
0x1001ab04
0x1001ab06
0x1001ab0a
0x1001ab10
0x1001ab13
0x1001ab14
0x1001ab19
0x1001ab1c
0x1001ab1f
0x1001ab24
0x1001ab27
0x1001ab2c
0x1001ab2f
0x1001ab34
0x1001ab3c
0x1001aaca
0x1001aad2
0x1001aad8
0x1001aadb
0x1001aaec
0x1001aa01
0x1001aa01
0x1001aa0c
0x00000000
0x1001aa12
0x1001aa19
0x1001aa23
0x1001aa26
0x1001aa2d
0x00000000
0x1001aa33
0x1001aa33
0x1001aa39
0x1001aa40
0x1001aa47
0x00000000
0x1001aa4d
0x1001aa4d
0x1001aa53
0x1001aa57
0x1001aa5d
0x1001aa5f
0x1001aa65
0x1001aa68
0x1001aa6e
0x1001aa71
0x1001aa77
0x1001a97f
0x1001a97f
0x1001a988
0x1001a98c
0x1001a98f
0x1001a992
0x1001a996
0x1001a99b
0x00000000
0x1001a99b
0x1001aa47
0x1001aa2d
0x1001aa0c
0x1001a9fb
0x00000000
0x00000000
0x00000000
0x00000000
0x1001a99f
0x1001a99f
0x1001a9a7
0x00000000
0x1001a9b3
0x00000000

APIs

mv_dict_copy.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A89A
mv_dict_copy.MAIN ref: 1001A996
mv_buffer_ref.MAIN ref: 1001A9EC
mv_realloc.MAIN ref: 1001AA26
mv_mallocz.MAIN ref: 1001AA40
mv_buffer_replace.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AB9F
mv_buffer_replace.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001ABBD

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_replacemv_dict_copy$mv_buffer_refmv_malloczmv_realloc
String ID:
API String ID: 1780483662-0
Opcode ID: 07b599f6d8ee219048b6128147e910c9945fa735575f1c6576c8cbb7c6ffcc6f
Instruction ID: 1c222d73e1748437048cd959b4fb099db9e50fe00274f25359b61923485b158e
Opcode Fuzzy Hash: 07b599f6d8ee219048b6128147e910c9945fa735575f1c6576c8cbb7c6ffcc6f
Instruction Fuzzy Hash: 71F1B5B49043468FC764CF29C580799BBE1FF49350F058A6EE9899B712E730E985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10023730 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E10023730(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t100;
				signed int _t104;
				void* _t108;
				char* _t112;
				intOrPtr _t127;
				char* _t128;
				void* _t131;
				char* _t132;
				signed int _t136;
				signed int _t138;
				void* _t139;
				signed int _t142;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int _t150;
				signed int _t153;
				signed int _t156;
				signed int _t159;
				signed int _t162;
				signed int _t163;
				signed int _t165;
				signed int _t167;
				void* _t168;
				signed int* _t169;

				_t169 = _t168 - E1008ED80(0x103c);
				_t136 = _t169[0x414];
				if(_t136 == 0) {
					_t169[2] = 1;
					 *_t169 =  &(_t169[0xc]);
					_t169[1] = 0;
					E10008880(0, 0, 1, 1);
					_t169[2] = 1;
					_t162 =  &(_t169[0x20c]);
					_t169[1] = 0;
					_t159 =  &(_t169[0x30c]);
					 *_t169 =  &(_t169[0x10c]);
					E10008880(0, _t159, _t162, 1);
					_t169[1] = 0;
					_t169[2] = 1;
					 *_t169 = _t162;
					E10008880(0, _t159, _t162, 1);
					_t169[2] = 0x10000;
					_t169[1] = 0;
					 *_t169 = _t159;
					E10008880(0, _t159, _t162, 1);
					_t100 =  *(_t169[0x41a]) & 0xffffff00 |  *(_t169[0x41a]) != 0x00000000;
					L8:
					if(_t169[0x415] >= 0xfffffff9 && _t100 != 0 && ( *0x100d568c & 0x00000002) != 0) {
						_t67 = _t169[0x415] + 8; // 0x101
						_t153 = _t67;
						_t112 = 0x100b367b;
						if(_t153 <= 0x40) {
							_t112 =  *(0x100b3880 + _t153 * 4);
						}
						_t169[2] = _t112;
						_t169[1] = "[%s] ";
						 *_t169 = _t162;
						E100089C0();
					}
					 *_t169 = _t159;
					_t169[2] = _t169[0x417];
					_t169[1] = _t169[0x416];
					E10008B70();
					_t104 = _t169[0xc];
					_t142 = _t169[0x10c];
					_t163 = _t169[0x20c];
					_t138 = _t169[0x30c];
					if( *_t104 != 0 ||  *_t142 != 0 ||  *_t163 != 0) {
						L12:
						_t165 = _t169[0x30d];
						_t148 = 0;
						if(_t165 != 0 && _t169[0x30e] >= _t165) {
							_t150 =  *(_t138 + _t165 - 1) & 0x000000ff;
							_t169[0xa] = _t150 == 0xa;
							_t148 = (_t150 & 0xffffff00 | _t150 == 0x0000000d | _t169[0xa]) & 0x000000ff;
						}
						 *(_t169[0x41a]) = _t148;
						goto L16;
					} else {
						if( *_t138 == 0) {
							L16:
							_t169[3] = _t104;
							_t169[2] = "%s%s%s%s";
							_t169[6] = _t138;
							_t169[5] = _t163;
							_t169[4] = _t142;
							_t169[1] = _t169[0x419];
							 *_t169 = _t169[0x418];
							_t108 = L10022FC0();
							 *_t169 = _t159;
							_t169[1] = 0;
							_t139 = _t108;
							E10009690(_t139, _t142, _t159, _t163);
							return _t139;
						}
						goto L12;
					}
				}
				_t169[2] = 1;
				_t167 =  &(_t169[0x10c]);
				_t169[1] = 0;
				 *_t169 =  &(_t169[0xc]);
				_t162 =  &(_t169[0x20c]);
				_t169[0xa] =  *_t136;
				E10008880(_t136, 0x10000, _t162, _t167);
				_t169[2] = 1;
				_t169[1] = 0;
				 *_t169 = _t167;
				E10008880(_t136, 0x10000, _t162, _t167);
				_t169[2] = 1;
				_t169[1] = 0;
				 *_t169 = _t162;
				E10008880(_t136, 0x10000, _t162, _t167);
				_t169[2] = 0x10000;
				_t159 =  &(_t169[0x30c]);
				_t169[1] = 0;
				 *_t169 = _t159;
				E10008880(_t136, _t159, _t162, _t167);
				_t156 = _t169[0xa];
				_t144 = 0 |  *(_t169[0x41a]) != 0x00000000;
				_t100 = _t144;
				if(_t156 != 0 && _t144 != 0) {
					_t127 =  *((intOrPtr*)(_t156 + 0x14));
					if(_t127 != 0) {
						_t146 =  *(_t136 + _t127);
						if(_t146 != 0) {
							_t131 =  *_t146;
							if(_t131 != 0) {
								 *_t169 = _t146;
								_t169[0xb] = _t156;
								_t169[0xa] = _t146;
								_t132 =  *((intOrPtr*)(_t131 + 4))();
								_t169[3] = _t169[0xa];
								_t169[2] = _t132;
								_t169[1] = "[%s @ %p] ";
								 *_t169 =  &(_t169[0xc]);
								E100089C0();
								_t156 = _t169[0xb];
							}
						}
					}
					 *_t169 = _t136;
					_t128 =  *((intOrPtr*)(_t156 + 4))();
					_t169[3] = _t136;
					_t169[1] = "[%s @ %p] ";
					 *_t169 = _t167;
					_t169[2] = _t128;
					E100089C0();
					_t100 = _t169[0x41a] & 0xffffff00 |  *(_t169[0x41a]) != 0x00000000;
				}
			}

0x1002373e
0x10023740
0x10023749
0x100239a7
0x100239b1
0x100239be
0x100239c2
0x100239ce
0x100239d2
0x100239d9
0x100239dd
0x100239e4
0x100239e7
0x100239ee
0x100239f2
0x100239f6
0x100239f9
0x10023a03
0x10023a09
0x10023a0d
0x10023a10
0x10023a20
0x1002385a
0x10023862
0x1002396c
0x1002396c
0x1002396f
0x10023977
0x10023979
0x10023979
0x10023980
0x10023989
0x1002398d
0x10023990
0x10023990
0x1002386c
0x10023876
0x10023881
0x10023885
0x1002388a
0x1002388e
0x10023895
0x1002389c
0x100238a6
0x100238b1
0x100238b1
0x100238b8
0x100238bc
0x100238c7
0x100238cf
0x100238de
0x100238de
0x100238e8
0x00000000
0x10023949
0x1002394c
0x100238eb
0x100238eb
0x100238f4
0x100238ff
0x10023903
0x10023907
0x1002390b
0x10023916
0x10023919
0x10023920
0x10023923
0x10023927
0x10023929
0x1002393a
0x1002393a
0x00000000
0x10023950
0x100238a6
0x1002375b
0x1002375f
0x10023768
0x10023770
0x10023773
0x1002377a
0x1002377e
0x10023788
0x1002378e
0x10023792
0x10023795
0x100237a1
0x100237a5
0x100237a9
0x100237ac
0x100237b3
0x100237b7
0x100237be
0x100237c2
0x100237c5
0x100237d1
0x100237d9
0x100237de
0x100237e0
0x100237e6
0x100237eb
0x100237ed
0x100237f2
0x100237f4
0x100237f8
0x100237fa
0x100237fd
0x10023801
0x10023805
0x1002380c
0x10023810
0x10023819
0x10023821
0x10023824
0x10023829
0x10023829
0x100237f8
0x100237f2
0x1002382d
0x10023830
0x10023838
0x1002383c
0x10023840
0x10023843
0x10023847
0x10023857
0x10023857

APIs

mv_bprint_init.MAIN ref: 1002377E
mv_bprint_init.MAIN ref: 10023795
mv_bprint_init.MAIN ref: 100237AC
mv_bprint_init.MAIN ref: 100237C5
mv_bprintf.MAIN ref: 10023824
mv_bprintf.MAIN ref: 10023847
mv_vbprintf.MAIN ref: 10023885
mv_bprint_finalize.MAIN ref: 10023929
mv_bprint_init.MAIN ref: 100239C2
mv_bprint_init.MAIN ref: 100239E7
mv_bprint_init.MAIN ref: 100239F9
mv_bprint_init.MAIN ref: 10023A10

Strings

%s%s%s%s, xrefs: 100238EF
[%s] , xrefs: 10023984
[%s @ %p] , xrefs: 10023814, 10023833

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init$mv_bprintf$mv_bprint_finalizemv_vbprintf
String ID: %s%s%s%s$[%s @ %p] $[%s]
API String ID: 2514531573-1798253436
Opcode ID: 73ec329c920999803a4babe89b4941ef9f254048450b1a5a3304028e830a3db2
Instruction ID: 6f949b97a94191d98c9e239c908f2f64f0d76179adbd4d945766b856959e5812
Opcode Fuzzy Hash: 73ec329c920999803a4babe89b4941ef9f254048450b1a5a3304028e830a3db2
Instruction Fuzzy Hash: 5F8106B49097809FD354DF28D08069BBBE5FF89380F95C92EF8C88B315DA749984CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BC98 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 179
stringCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1002BC98(void* __ebx, void* __ecx, void* __edi, signed int __esi, char* __ebp, int __fp0, char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a40, char* _a44, char _a60) {
				signed int _t80;
				void* _t84;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t96;
				signed int _t98;
				char* _t100;
				intOrPtr* _t102;
				int _t110;

				_t110 = __fp0;
				_t100 = __ebp;
				_t98 = __esi;
				_t96 = __edi;
				_t84 = __ebx;
				while(1) {
					L13:
					asm("movsd xmm0, [ebx+0x10]");
					__edx = __ebx;
					_a4 = 1;
					_a8 = 0;
					 *__esp = 1;
					E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					while(1) {
						L10:
						_t91 =  *((intOrPtr*)(_t84 + 0x30));
						if(_t91 == 0) {
							break;
						}
						_t84 = _t84 + 0x30;
						_t80 =  *(_t84 + 0x28);
						if((_t80 & _t98) != _t96 || (_t80 & 0x00000080) != 0) {
							continue;
						} else {
							_t80 =  *(_t84 + 0xc);
							_t90 =  *((intOrPtr*)(_t84 + 8)) + _t100;
							if(_t80 > 0x13) {
								_a16 = _t91;
								_a12 = _t80;
								_a8 = "AVOption type %d of option %s not implemented yet\n";
								_a4 = 0x30;
								 *_t102 = _t100;
								_t80 = E10023A40();
								continue;
							}
							switch( *((intOrPtr*)(_t80 * 4 +  &M100B45A0))) {
								case 0:
									goto L12;
								case 1:
									goto L13;
								case 2:
									_a40 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a44 = __ebx[0x10];
									E100265C0();
									__eax = _a44;
									__eax = E100267C0(__ebx, __edi, __esi, __ebp, _a44);
									__ecx = _a40;
									 *__ecx = __eax;
									goto L10;
								case 3:
									_a40 = __ecx;
									__eax = 0x7fffffff;
									_a8 = 0x7fffffff;
									asm("movsd xmm0, [ebx+0x10]");
									asm("movsd [esp], xmm0");
									__eax = L10032F80(0x7fffffff, __ebx, __edi, __esi);
									__ecx = _a40;
									asm("movsd xmm0, [0x100b49f8]");
									_a4 = __eax;
									_a8 = __eax;
									__eax = __ebp;
									 *__esp = __edx;
									__edx = __ebx;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 4:
									__eax = __ebx[0x10];
									__edx = __ecx;
									__eax = E10028BF0(__ebx[0x10], __ecx);
									goto L10;
								case 5:
									__eax = __ebx[0x10];
									__edx = 0;
									_a60 = 0;
									if(__eax == 0) {
										L26:
										 *__esp = __ecx;
										_a40 = __ecx;
										E10011CC0();
										__eax = _a60;
										__ecx = _a40;
										 *__ecx = _a60;
										goto L10;
									}
									_a40 = __ecx;
									__edx = L":=";
									__ecx = 0;
									_a16 = 0;
									__ecx = 0x100b4567;
									_a12 = L":=";
									__edx =  &_a60;
									_a8 = 0x100b4567;
									 *__esp =  &_a60;
									_a4 = __eax;
									__eax = E100118C0();
									__ecx = _a40;
									__edx =  &_a60;
									if(__eax < 0) {
										E10011CC0( &_a60);
										goto L10;
									}
									goto L26;
								case 6:
									goto L10;
								case 7:
									__edx = __ebx[0x10];
									if(__edx == 0) {
										L28:
										__ecx[4] = 0;
										 *__ecx = 0;
										goto L10;
									}
									 *__esp = __edx;
									__eax = 0x100b3bdc;
									_a4 = 0x100b3bdc;
									_a44 = __ecx;
									_a40 = __edx;
									__eax = strcmp(??, ??);
									__edx = _a40;
									__ecx = _a44;
									if(__eax == 0) {
										goto L28;
									} else {
										_a8 = __edx;
										__eax =  &(__ecx[4]);
										_a4 =  &(__ecx[4]);
										 *__esp = __ecx;
										_a40 = __edx;
										__eax = E1002E6E0();
										__edx = _a40;
										if(__eax < 0) {
											_a12 = __edx;
											__eax = "Unable to parse option value \"%s\" as image size\n";
											_a8 = "Unable to parse option value \"%s\" as image size\n";
											__eax = 0x10;
											_a4 = 0x10;
											 *__esp = __ebp;
											__eax = E10023A40();
										}
										goto L10;
									}
								case 8:
									__edx = __ebx[0x10];
									 *__esp = __ecx;
									_a4 = __edx;
									_a40 = __edx;
									__eax = E1002E7A0();
									__edx = _a40;
									if(__eax < 0) {
										_a12 = __edx;
										__ecx = "Unable to parse option value \"%s\" as video rate\n";
										__eax = 0x10;
										_a8 = "Unable to parse option value \"%s\" as video rate\n";
										_a4 = 0x10;
										 *__esp = __ebp;
										__eax = E10023A40();
									}
									goto L10;
								case 9:
									_t93 =  *((intOrPtr*)(_t84 + 0x10));
									if(_t93 == 0) {
										goto L10;
									}
									_a4 = _t93;
									_a12 = _t100;
									_a8 = 0xffffffff;
									 *_t102 = _t90;
									_a40 = _t93;
									_t80 = E1002E900(_t110);
									_t94 = _a40;
									if(_t80 < 0) {
										_a12 = _t94;
										_a8 = "Unable to parse option value \"%s\" as color\n";
										_a4 = 0x10;
										 *_t102 = _t100;
										_t80 = E10023A40();
										goto L10;
									}
									if(_t84 != 0) {
										goto L10;
									}
									goto L8;
								case 0xa:
									_a44 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a40 = __ebx[0x10];
									__eax = E1000D270();
									__eax = _a40;
									if(__eax != 0) {
										_a4 = __eax;
										__ecx = _a44;
										 *__esp = _a44;
										__eax = E1000DD40(__fp0);
									}
									goto L10;
							}
						}
						L12:
						asm("movsd xmm0, [0x100b49f8]");
						__edx = __ebx[0x14];
						 *__esp = 1;
						_a4 = __ebx[0x10];
						_a8 = __ebx[0x14];
						__edx = __ebx;
						E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					}
					L8:
					return _t80;
				}
			}

0x1002bc98
0x1002bc98
0x1002bc98
0x1002bc98
0x1002bc98
0x1002bca0
0x1002bca0
0x1002bca5
0x1002bcaa
0x1002bcac
0x1002bcb2
0x1002bcb8
0x1002bcbf
0x1002bc60
0x1002bc60
0x1002bc60
0x1002bc65
0x00000000
0x00000000
0x1002bc67
0x1002bbbb
0x1002bbc4
0x00000000
0x1002bbd2
0x1002bbd5
0x1002bbd8
0x1002bbdd
0x1002be90
0x1002be99
0x1002bea2
0x1002bea6
0x1002beaa
0x1002bead
0x00000000
0x1002bead
0x1002bbe3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bc30
0x1002bc34
0x1002bc37
0x1002bc3a
0x1002bc3e
0x1002bc43
0x1002bc4a
0x1002bc4f
0x1002bc53
0x00000000
0x00000000
0x1002bd20
0x1002bd24
0x1002bd29
0x1002bd2d
0x1002bd32
0x1002bd37
0x1002bd3c
0x1002bd40
0x1002bd48
0x1002bd4f
0x1002bd53
0x1002bd55
0x1002bd58
0x1002bd5a
0x00000000
0x00000000
0x1002bd08
0x1002bd0b
0x1002bd0d
0x00000000
0x00000000
0x1002be30
0x1002be33
0x1002be35
0x1002be3b
0x1002be75
0x1002be75
0x1002be78
0x1002be7c
0x1002be81
0x1002be85
0x1002be89
0x00000000
0x1002be89
0x1002be3d
0x1002be41
0x1002be46
0x1002be48
0x1002be4c
0x1002be51
0x1002be55
0x1002be59
0x1002be5d
0x1002be60
0x1002be64
0x1002be69
0x1002be6d
0x1002be73
0x1002bed5
0x00000000
0x1002bed5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bdb0
0x1002bdb5
0x1002bec0
0x1002bec0
0x1002bec7
0x00000000
0x1002bec7
0x1002bdbb
0x1002bdbe
0x1002bdc3
0x1002bdc7
0x1002bdcb
0x1002bdcf
0x1002bdd4
0x1002bdd8
0x1002bdde
0x00000000
0x1002bde4
0x1002bde4
0x1002bde8
0x1002bdeb
0x1002bdef
0x1002bdf2
0x1002bdf6
0x1002bdfb
0x1002be01
0x1002be07
0x1002be0b
0x1002be10
0x1002be14
0x1002be19
0x1002be1d
0x1002be20
0x1002be20
0x00000000
0x1002be01
0x00000000
0x1002bd68
0x1002bd6b
0x1002bd6e
0x1002bd72
0x1002bd76
0x1002bd7b
0x1002bd81
0x1002bd87
0x1002bd8b
0x1002bd90
0x1002bd95
0x1002bd99
0x1002bd9d
0x1002bda0
0x1002bda0
0x00000000
0x00000000
0x1002bbf0
0x1002bbf5
0x00000000
0x00000000
0x1002bbf7
0x1002bc00
0x1002bc04
0x1002bc08
0x1002bc0b
0x1002bc0f
0x1002bc14
0x1002bc1a
0x1002bedf
0x1002beed
0x1002bef1
0x1002bef5
0x1002bef8
0x00000000
0x1002bef8
0x1002bc22
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bcd0
0x1002bcd4
0x1002bcd7
0x1002bcda
0x1002bcde
0x1002bce3
0x1002bce9
0x1002bcef
0x1002bcf3
0x1002bcf7
0x1002bcfa
0x1002bcfa
0x00000000
0x00000000
0x1002bbe3
0x1002bc70
0x1002bc73
0x1002bc7b
0x1002bc7e
0x1002bc85
0x1002bc8b
0x1002bc8f
0x1002bc91
0x1002bc91
0x1002bc24
0x1002bc2b
0x1002bc2b

APIs

mv_parse_color.MAIN ref: 1002BC0F
mv_freep.MAIN ref: 1002BC3E
mv_strdup.MAIN ref: 1002BC4A
mv_channel_layout_uninit.MAIN ref: 1002BCDE
mv_channel_layout_from_string.MAIN ref: 1002BCFA
mv_d2q.MAIN ref: 1002BD37
mv_parse_video_rate.MAIN ref: 1002BD76
mv_log.MAIN ref: 1002BDA0
strcmp.MSVCRT ref: 1002BDCF
mv_parse_video_size.MAIN ref: 1002BDF6
mv_log.MAIN ref: 1002BE20
mv_dict_parse_string.MAIN ref: 1002BE64
mv_dict_free.MAIN ref: 1002BE7C
mv_log.MAIN ref: 1002BEAD

Strings

Unable to parse option value "%s" as image size, xrefs: 1002BE0B
none, xrefs: 1002BDBE
Unable to parse option value "%s" as video rate, xrefs: 1002BD8B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_channel_layout_from_stringmv_channel_layout_uninitmv_d2qmv_dict_freemv_dict_parse_stringmv_freepmv_parse_colormv_parse_video_ratemv_parse_video_sizemv_strdupstrcmp
String ID: Unable to parse option value "%s" as image size$Unable to parse option value "%s" as video rate$none
API String ID: 1998427758-3528850829
Opcode ID: 97c540a3f4510b3ed1ba97b6e95b6114bb4835aa925a1049b8c96e6e294c9c35
Instruction ID: c1bdd990a2f20c3f4a12ccae751addf03ef500cd3a7f6d380a48df772618b1d0
Opcode Fuzzy Hash: 97c540a3f4510b3ed1ba97b6e95b6114bb4835aa925a1049b8c96e6e294c9c35
Instruction Fuzzy Hash: 4071D4B8608B058FC704DF29E0C061BBBE5FFC8754F65892EF8999B325DA30D9419B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BCC6 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1002BCC6(void* __ebx, void* __ecx, void* __edi, signed int __esi, char* __ebp, int __fp0, char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a40, char* _a44, char _a60) {
				signed int _t80;
				void* _t84;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t96;
				signed int _t98;
				char* _t100;
				intOrPtr* _t102;
				int _t110;

				_t110 = __fp0;
				_t100 = __ebp;
				_t98 = __esi;
				_t96 = __edi;
				_t84 = __ebx;
				while(1) {
					L14:
					_a44 = __ecx;
					__eax = __ebx[0x10];
					 *__esp = __ecx;
					_a40 = __ebx[0x10];
					__eax = E1000D270();
					__eax = _a40;
					if(__eax != 0) {
						_a4 = __eax;
						__ecx = _a44;
						 *__esp = _a44;
						__eax = E1000DD40(__fp0);
					}
					while(1) {
						L10:
						_t91 =  *((intOrPtr*)(_t84 + 0x30));
						if(_t91 == 0) {
							break;
						}
						_t84 = _t84 + 0x30;
						_t80 =  *(_t84 + 0x28);
						if((_t80 & _t98) != _t96 || (_t80 & 0x00000080) != 0) {
							continue;
						} else {
							_t80 =  *(_t84 + 0xc);
							_t90 =  *((intOrPtr*)(_t84 + 8)) + _t100;
							if(_t80 > 0x13) {
								_a16 = _t91;
								_a12 = _t80;
								_a8 = "AVOption type %d of option %s not implemented yet\n";
								_a4 = 0x30;
								 *_t102 = _t100;
								_t80 = E10023A40();
								continue;
							}
							switch( *((intOrPtr*)(_t80 * 4 +  &M100B45A0))) {
								case 0:
									goto L12;
								case 1:
									__eax = 1;
									asm("movsd xmm0, [ebx+0x10]");
									__edx = __ebx;
									_a4 = 1;
									__eax = 0;
									_a8 = 0;
									__eax = __ebp;
									 *__esp = 1;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 2:
									_a40 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a44 = __ebx[0x10];
									E100265C0();
									__eax = _a44;
									__eax = E100267C0(__ebx, __edi, __esi, __ebp, _a44);
									__ecx = _a40;
									 *__ecx = __eax;
									goto L10;
								case 3:
									_a40 = __ecx;
									__eax = 0x7fffffff;
									_a8 = 0x7fffffff;
									asm("movsd xmm0, [ebx+0x10]");
									asm("movsd [esp], xmm0");
									__eax = L10032F80(0x7fffffff, __ebx, __edi, __esi);
									__ecx = _a40;
									asm("movsd xmm0, [0x100b49f8]");
									_a4 = __eax;
									_a8 = __eax;
									__eax = __ebp;
									 *__esp = __edx;
									__edx = __ebx;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 4:
									__eax = __ebx[0x10];
									__edx = __ecx;
									__eax = E10028BF0(__ebx[0x10], __ecx);
									goto L10;
								case 5:
									__eax = __ebx[0x10];
									__edx = 0;
									_a60 = 0;
									if(__eax == 0) {
										L26:
										 *__esp = __ecx;
										_a40 = __ecx;
										E10011CC0();
										__eax = _a60;
										__ecx = _a40;
										 *__ecx = _a60;
										goto L10;
									}
									_a40 = __ecx;
									__edx = L":=";
									__ecx = 0;
									_a16 = 0;
									__ecx = 0x100b4567;
									_a12 = L":=";
									__edx =  &_a60;
									_a8 = 0x100b4567;
									 *__esp =  &_a60;
									_a4 = __eax;
									__eax = E100118C0();
									__ecx = _a40;
									__edx =  &_a60;
									if(__eax < 0) {
										E10011CC0( &_a60);
										goto L10;
									}
									goto L26;
								case 6:
									goto L10;
								case 7:
									__edx = __ebx[0x10];
									if(__edx == 0) {
										L28:
										__ecx[4] = 0;
										 *__ecx = 0;
										goto L10;
									}
									 *__esp = __edx;
									__eax = 0x100b3bdc;
									_a4 = 0x100b3bdc;
									_a44 = __ecx;
									_a40 = __edx;
									__eax = strcmp(??, ??);
									__edx = _a40;
									__ecx = _a44;
									if(__eax == 0) {
										goto L28;
									} else {
										_a8 = __edx;
										__eax =  &(__ecx[4]);
										_a4 =  &(__ecx[4]);
										 *__esp = __ecx;
										_a40 = __edx;
										__eax = E1002E6E0();
										__edx = _a40;
										if(__eax < 0) {
											_a12 = __edx;
											__eax = "Unable to parse option value \"%s\" as image size\n";
											_a8 = "Unable to parse option value \"%s\" as image size\n";
											__eax = 0x10;
											_a4 = 0x10;
											 *__esp = __ebp;
											__eax = E10023A40();
										}
										goto L10;
									}
								case 8:
									__edx = __ebx[0x10];
									 *__esp = __ecx;
									_a4 = __edx;
									_a40 = __edx;
									__eax = E1002E7A0();
									__edx = _a40;
									if(__eax < 0) {
										_a12 = __edx;
										__ecx = "Unable to parse option value \"%s\" as video rate\n";
										__eax = 0x10;
										_a8 = "Unable to parse option value \"%s\" as video rate\n";
										_a4 = 0x10;
										 *__esp = __ebp;
										__eax = E10023A40();
									}
									goto L10;
								case 9:
									_t93 =  *((intOrPtr*)(_t84 + 0x10));
									if(_t93 == 0) {
										goto L10;
									}
									_a4 = _t93;
									_a12 = _t100;
									_a8 = 0xffffffff;
									 *_t102 = _t90;
									_a40 = _t93;
									_t80 = E1002E900(_t110);
									_t94 = _a40;
									if(_t80 < 0) {
										_a12 = _t94;
										_a8 = "Unable to parse option value \"%s\" as color\n";
										_a4 = 0x10;
										 *_t102 = _t100;
										_t80 = E10023A40();
										goto L10;
									}
									if(_t84 != 0) {
										goto L10;
									}
									goto L8;
								case 0xa:
									goto L14;
							}
						}
						L12:
						__eax = __ebx[0x10];
						asm("movsd xmm0, [0x100b49f8]");
						__edx = __ebx[0x14];
						 *__esp = 1;
						_a4 = __ebx[0x10];
						__eax = __ebp;
						_a8 = __ebx[0x14];
						__edx = __ebx;
						__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					}
					L8:
					return _t80;
				}
			}

0x1002bcc6
0x1002bcc6
0x1002bcc6
0x1002bcc6
0x1002bcc6
0x1002bcd0
0x1002bcd0
0x1002bcd0
0x1002bcd4
0x1002bcd7
0x1002bcda
0x1002bcde
0x1002bce3
0x1002bce9
0x1002bcef
0x1002bcf3
0x1002bcf7
0x1002bcfa
0x1002bcfa
0x1002bc60
0x1002bc60
0x1002bc60
0x1002bc65
0x00000000
0x00000000
0x1002bc67
0x1002bbbb
0x1002bbc4
0x00000000
0x1002bbd2
0x1002bbd5
0x1002bbd8
0x1002bbdd
0x1002be90
0x1002be99
0x1002bea2
0x1002bea6
0x1002beaa
0x1002bead
0x00000000
0x1002bead
0x1002bbe3
0x00000000
0x00000000
0x00000000
0x1002bca0
0x1002bca5
0x1002bcaa
0x1002bcac
0x1002bcb0
0x1002bcb2
0x1002bcb6
0x1002bcb8
0x1002bcbf
0x00000000
0x00000000
0x1002bc30
0x1002bc34
0x1002bc37
0x1002bc3a
0x1002bc3e
0x1002bc43
0x1002bc4a
0x1002bc4f
0x1002bc53
0x00000000
0x00000000
0x1002bd20
0x1002bd24
0x1002bd29
0x1002bd2d
0x1002bd32
0x1002bd37
0x1002bd3c
0x1002bd40
0x1002bd48
0x1002bd4f
0x1002bd53
0x1002bd55
0x1002bd58
0x1002bd5a
0x00000000
0x00000000
0x1002bd08
0x1002bd0b
0x1002bd0d
0x00000000
0x00000000
0x1002be30
0x1002be33
0x1002be35
0x1002be3b
0x1002be75
0x1002be75
0x1002be78
0x1002be7c
0x1002be81
0x1002be85
0x1002be89
0x00000000
0x1002be89
0x1002be3d
0x1002be41
0x1002be46
0x1002be48
0x1002be4c
0x1002be51
0x1002be55
0x1002be59
0x1002be5d
0x1002be60
0x1002be64
0x1002be69
0x1002be6d
0x1002be73
0x1002bed5
0x00000000
0x1002bed5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bdb0
0x1002bdb5
0x1002bec0
0x1002bec0
0x1002bec7
0x00000000
0x1002bec7
0x1002bdbb
0x1002bdbe
0x1002bdc3
0x1002bdc7
0x1002bdcb
0x1002bdcf
0x1002bdd4
0x1002bdd8
0x1002bdde
0x00000000
0x1002bde4
0x1002bde4
0x1002bde8
0x1002bdeb
0x1002bdef
0x1002bdf2
0x1002bdf6
0x1002bdfb
0x1002be01
0x1002be07
0x1002be0b
0x1002be10
0x1002be14
0x1002be19
0x1002be1d
0x1002be20
0x1002be20
0x00000000
0x1002be01
0x00000000
0x1002bd68
0x1002bd6b
0x1002bd6e
0x1002bd72
0x1002bd76
0x1002bd7b
0x1002bd81
0x1002bd87
0x1002bd8b
0x1002bd90
0x1002bd95
0x1002bd99
0x1002bd9d
0x1002bda0
0x1002bda0
0x00000000
0x00000000
0x1002bbf0
0x1002bbf5
0x00000000
0x00000000
0x1002bbf7
0x1002bc00
0x1002bc04
0x1002bc08
0x1002bc0b
0x1002bc0f
0x1002bc14
0x1002bc1a
0x1002bedf
0x1002beed
0x1002bef1
0x1002bef5
0x1002bef8
0x00000000
0x1002bef8
0x1002bc22
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bbe3
0x1002bc70
0x1002bc70
0x1002bc73
0x1002bc7b
0x1002bc7e
0x1002bc85
0x1002bc89
0x1002bc8b
0x1002bc8f
0x1002bc91
0x1002bc91
0x1002bc24
0x1002bc2b
0x1002bc2b

APIs

mv_channel_layout_uninit.MAIN ref: 1002BCDE
mv_channel_layout_from_string.MAIN ref: 1002BCFA

Part of subcall function 1000DD40: strcmp.MSVCRT ref: 1000DD7C

Strings

Unable to parse option value "%s" as image size, xrefs: 1002BE0B
none, xrefs: 1002BDBE
Unable to parse option value "%s" as video rate, xrefs: 1002BD8B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_from_stringmv_channel_layout_uninitstrcmp
String ID: Unable to parse option value "%s" as image size$Unable to parse option value "%s" as video rate$none
API String ID: 3643031241-3528850829
Opcode ID: 869de1b27b69639d8428b4c11adaa7d81cdf19cc4956a37caa71edf54d01aa04
Instruction ID: 4d96175585a952f578fc4bb564dcf7cc73542298dd52a5f32124ed67072f1695
Opcode Fuzzy Hash: 869de1b27b69639d8428b4c11adaa7d81cdf19cc4956a37caa71edf54d01aa04
Instruction Fuzzy Hash: E571C7B8608B058FC744DF29D0C061BBBE5FFC8754F65892EF8999B315DA30D9419B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BD17 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 179
stringCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1002BD17(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, signed int __esi, char* __ebp, int __fp0, char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a40, char* _a44, char _a60) {
				signed int _t80;
				void* _t84;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t96;
				signed int _t98;
				char* _t100;
				intOrPtr* _t102;
				int _t110;

				_t110 = __fp0;
				_t100 = __ebp;
				_t98 = __esi;
				_t96 = __edi;
				_t91 = __edx;
				_t84 = __ebx;
				while(1) {
					L17:
					_a40 = __ecx;
					__eax = 0x7fffffff;
					_a8 = 0x7fffffff;
					asm("movsd xmm0, [ebx+0x10]");
					asm("movsd [esp], xmm0");
					__eax = L10032F80(0x7fffffff, __ebx, __edi, __esi);
					__ecx = _a40;
					asm("movsd xmm0, [0x100b49f8]");
					_a4 = __eax;
					_a8 = __eax;
					__eax = __ebp;
					 *__esp = __edx;
					__edx = __ebx;
					__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					while(1) {
						L10:
						_t91 =  *((intOrPtr*)(_t84 + 0x30));
						if(_t91 == 0) {
							break;
						}
						_t84 = _t84 + 0x30;
						_t80 =  *(_t84 + 0x28);
						if((_t80 & _t98) != _t96 || (_t80 & 0x00000080) != 0) {
							continue;
						} else {
							_t80 =  *(_t84 + 0xc);
							_t90 =  *((intOrPtr*)(_t84 + 8)) + _t100;
							if(_t80 > 0x13) {
								_a16 = _t91;
								_a12 = _t80;
								_a8 = "AVOption type %d of option %s not implemented yet\n";
								_a4 = 0x30;
								 *_t102 = _t100;
								_t80 = E10023A40();
								continue;
							}
							switch( *((intOrPtr*)(_t80 * 4 +  &M100B45A0))) {
								case 0:
									goto L12;
								case 1:
									__eax = 1;
									asm("movsd xmm0, [ebx+0x10]");
									__edx = __ebx;
									_a4 = 1;
									__eax = 0;
									_a8 = 0;
									__eax = __ebp;
									 *__esp = 1;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 2:
									_a40 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a44 = __ebx[0x10];
									E100265C0();
									__eax = _a44;
									__eax = E100267C0(__ebx, __edi, __esi, __ebp, _a44);
									__ecx = _a40;
									 *__ecx = __eax;
									goto L10;
								case 3:
									goto L17;
								case 4:
									__eax = __ebx[0x10];
									__edx = __ecx;
									__eax = E10028BF0(__ebx[0x10], __ecx);
									goto L10;
								case 5:
									__eax = __ebx[0x10];
									__edx = 0;
									_a60 = 0;
									if(__eax == 0) {
										L26:
										 *__esp = __ecx;
										_a40 = __ecx;
										E10011CC0();
										__eax = _a60;
										__ecx = _a40;
										 *__ecx = _a60;
										goto L10;
									}
									_a40 = __ecx;
									__edx = L":=";
									__ecx = 0;
									_a16 = 0;
									__ecx = 0x100b4567;
									_a12 = L":=";
									__edx =  &_a60;
									_a8 = 0x100b4567;
									 *__esp =  &_a60;
									_a4 = __eax;
									__eax = E100118C0();
									__ecx = _a40;
									__edx =  &_a60;
									if(__eax < 0) {
										E10011CC0( &_a60);
										goto L10;
									}
									goto L26;
								case 6:
									goto L10;
								case 7:
									__edx = __ebx[0x10];
									if(__edx == 0) {
										L28:
										__ecx[4] = 0;
										 *__ecx = 0;
										goto L10;
									}
									 *__esp = __edx;
									__eax = 0x100b3bdc;
									_a4 = 0x100b3bdc;
									_a44 = __ecx;
									_a40 = __edx;
									__eax = strcmp(??, ??);
									__edx = _a40;
									__ecx = _a44;
									if(__eax == 0) {
										goto L28;
									} else {
										_a8 = __edx;
										__eax =  &(__ecx[4]);
										_a4 =  &(__ecx[4]);
										 *__esp = __ecx;
										_a40 = __edx;
										__eax = E1002E6E0();
										__edx = _a40;
										if(__eax < 0) {
											_a12 = __edx;
											__eax = "Unable to parse option value \"%s\" as image size\n";
											_a8 = "Unable to parse option value \"%s\" as image size\n";
											__eax = 0x10;
											_a4 = 0x10;
											 *__esp = __ebp;
											__eax = E10023A40();
										}
										goto L10;
									}
								case 8:
									__edx = __ebx[0x10];
									 *__esp = __ecx;
									_a4 = __edx;
									_a40 = __edx;
									__eax = E1002E7A0();
									__edx = _a40;
									if(__eax < 0) {
										_a12 = __edx;
										__ecx = "Unable to parse option value \"%s\" as video rate\n";
										__eax = 0x10;
										_a8 = "Unable to parse option value \"%s\" as video rate\n";
										_a4 = 0x10;
										 *__esp = __ebp;
										__eax = E10023A40();
									}
									goto L10;
								case 9:
									_t93 =  *((intOrPtr*)(_t84 + 0x10));
									if(_t93 == 0) {
										goto L10;
									}
									_a4 = _t93;
									_a12 = _t100;
									_a8 = 0xffffffff;
									 *_t102 = _t90;
									_a40 = _t93;
									_t80 = E1002E900(_t110);
									_t94 = _a40;
									if(_t80 < 0) {
										_a12 = _t94;
										_a8 = "Unable to parse option value \"%s\" as color\n";
										_a4 = 0x10;
										 *_t102 = _t100;
										_t80 = E10023A40();
										goto L10;
									}
									if(_t84 != 0) {
										goto L10;
									}
									goto L8;
								case 0xa:
									_a44 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a40 = __ebx[0x10];
									__eax = E1000D270();
									__eax = _a40;
									if(__eax != 0) {
										_a4 = __eax;
										__ecx = _a44;
										 *__esp = _a44;
										__eax = E1000DD40(__fp0);
									}
									goto L10;
							}
						}
						L12:
						__eax = __ebx[0x10];
						asm("movsd xmm0, [0x100b49f8]");
						__edx = __ebx[0x14];
						 *__esp = 1;
						_a4 = __ebx[0x10];
						__eax = __ebp;
						_a8 = __ebx[0x14];
						__edx = __ebx;
						__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					}
					L8:
					return _t80;
				}
			}

0x1002bd17
0x1002bd17
0x1002bd17
0x1002bd17
0x1002bd17
0x1002bd17
0x1002bd20
0x1002bd20
0x1002bd20
0x1002bd24
0x1002bd29
0x1002bd2d
0x1002bd32
0x1002bd37
0x1002bd3c
0x1002bd40
0x1002bd48
0x1002bd4f
0x1002bd53
0x1002bd55
0x1002bd58
0x1002bd5a
0x1002bc60
0x1002bc60
0x1002bc60
0x1002bc65
0x00000000
0x00000000
0x1002bc67
0x1002bbbb
0x1002bbc4
0x00000000
0x1002bbd2
0x1002bbd5
0x1002bbd8
0x1002bbdd
0x1002be90
0x1002be99
0x1002bea2
0x1002bea6
0x1002beaa
0x1002bead
0x00000000
0x1002bead
0x1002bbe3
0x00000000
0x00000000
0x00000000
0x1002bca0
0x1002bca5
0x1002bcaa
0x1002bcac
0x1002bcb0
0x1002bcb2
0x1002bcb6
0x1002bcb8
0x1002bcbf
0x00000000
0x00000000
0x1002bc30
0x1002bc34
0x1002bc37
0x1002bc3a
0x1002bc3e
0x1002bc43
0x1002bc4a
0x1002bc4f
0x1002bc53
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bd08
0x1002bd0b
0x1002bd0d
0x00000000
0x00000000
0x1002be30
0x1002be33
0x1002be35
0x1002be3b
0x1002be75
0x1002be75
0x1002be78
0x1002be7c
0x1002be81
0x1002be85
0x1002be89
0x00000000
0x1002be89
0x1002be3d
0x1002be41
0x1002be46
0x1002be48
0x1002be4c
0x1002be51
0x1002be55
0x1002be59
0x1002be5d
0x1002be60
0x1002be64
0x1002be69
0x1002be6d
0x1002be73
0x1002bed5
0x00000000
0x1002bed5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bdb0
0x1002bdb5
0x1002bec0
0x1002bec0
0x1002bec7
0x00000000
0x1002bec7
0x1002bdbb
0x1002bdbe
0x1002bdc3
0x1002bdc7
0x1002bdcb
0x1002bdcf
0x1002bdd4
0x1002bdd8
0x1002bdde
0x00000000
0x1002bde4
0x1002bde4
0x1002bde8
0x1002bdeb
0x1002bdef
0x1002bdf2
0x1002bdf6
0x1002bdfb
0x1002be01
0x1002be07
0x1002be0b
0x1002be10
0x1002be14
0x1002be19
0x1002be1d
0x1002be20
0x1002be20
0x00000000
0x1002be01
0x00000000
0x1002bd68
0x1002bd6b
0x1002bd6e
0x1002bd72
0x1002bd76
0x1002bd7b
0x1002bd81
0x1002bd87
0x1002bd8b
0x1002bd90
0x1002bd95
0x1002bd99
0x1002bd9d
0x1002bda0
0x1002bda0
0x00000000
0x00000000
0x1002bbf0
0x1002bbf5
0x00000000
0x00000000
0x1002bbf7
0x1002bc00
0x1002bc04
0x1002bc08
0x1002bc0b
0x1002bc0f
0x1002bc14
0x1002bc1a
0x1002bedf
0x1002beed
0x1002bef1
0x1002bef5
0x1002bef8
0x00000000
0x1002bef8
0x1002bc22
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bcd0
0x1002bcd4
0x1002bcd7
0x1002bcda
0x1002bcde
0x1002bce3
0x1002bce9
0x1002bcef
0x1002bcf3
0x1002bcf7
0x1002bcfa
0x1002bcfa
0x00000000
0x00000000
0x1002bbe3
0x1002bc70
0x1002bc70
0x1002bc73
0x1002bc7b
0x1002bc7e
0x1002bc85
0x1002bc89
0x1002bc8b
0x1002bc8f
0x1002bc91
0x1002bc91
0x1002bc24
0x1002bc2b
0x1002bc2b

APIs

mv_parse_color.MAIN ref: 1002BC0F
mv_freep.MAIN ref: 1002BC3E
mv_strdup.MAIN ref: 1002BC4A
mv_channel_layout_uninit.MAIN ref: 1002BCDE
mv_channel_layout_from_string.MAIN ref: 1002BCFA
mv_d2q.MAIN ref: 1002BD37
mv_parse_video_rate.MAIN ref: 1002BD76
mv_log.MAIN ref: 1002BDA0
strcmp.MSVCRT ref: 1002BDCF
mv_parse_video_size.MAIN ref: 1002BDF6
mv_log.MAIN ref: 1002BE20
mv_dict_parse_string.MAIN ref: 1002BE64
mv_dict_free.MAIN ref: 1002BE7C
mv_log.MAIN ref: 1002BEAD

Strings

Unable to parse option value "%s" as image size, xrefs: 1002BE0B
none, xrefs: 1002BDBE
Unable to parse option value "%s" as video rate, xrefs: 1002BD8B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_channel_layout_from_stringmv_channel_layout_uninitmv_d2qmv_dict_freemv_dict_parse_stringmv_freepmv_parse_colormv_parse_video_ratemv_parse_video_sizemv_strdupstrcmp
String ID: Unable to parse option value "%s" as image size$Unable to parse option value "%s" as video rate$none
API String ID: 1998427758-3528850829
Opcode ID: 682a93362a380ee45b8835578824e64bcd12daf4dd5593fa54e69718ab5cbdd2
Instruction ID: b85c6a8754afb748ece121f0e61cf7902537c0c8ea1441f4fca8a035cbf7cb2a
Opcode Fuzzy Hash: 682a93362a380ee45b8835578824e64bcd12daf4dd5593fa54e69718ab5cbdd2
Instruction Fuzzy Hash: 1871D4B8608B058FC704DF29E0C061BBBE5FFC8754F65892EF8999B325DA30D9419B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BC2C Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1002BC2C(void* __ebx, void* __ecx, void* __edi, signed int __esi, char* __ebp, int __fp0, char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a40, char* _a44, char _a60) {
				signed int _t80;
				void* _t84;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t96;
				signed int _t98;
				char* _t100;
				intOrPtr* _t102;
				int _t110;

				_t110 = __fp0;
				_t100 = __ebp;
				_t98 = __esi;
				_t96 = __edi;
				_t84 = __ebx;
				while(1) {
					L9:
					_a40 = __ecx;
					__eax = __ebx[0x10];
					 *__esp = __ecx;
					_a44 = __ebx[0x10];
					E100265C0();
					__eax = _a44;
					__eax = E100267C0(__ebx, __edi, __esi, __ebp, _a44);
					__ecx = _a40;
					 *__ecx = __eax;
					while(1) {
						L10:
						_t91 =  *((intOrPtr*)(_t84 + 0x30));
						if(_t91 == 0) {
							break;
						}
						_t84 = _t84 + 0x30;
						_t80 =  *(_t84 + 0x28);
						if((_t80 & _t98) != _t96 || (_t80 & 0x00000080) != 0) {
							continue;
						} else {
							_t80 =  *(_t84 + 0xc);
							_t90 =  *((intOrPtr*)(_t84 + 8)) + _t100;
							if(_t80 > 0x13) {
								_a16 = _t91;
								_a12 = _t80;
								_a8 = "AVOption type %d of option %s not implemented yet\n";
								_a4 = 0x30;
								 *_t102 = _t100;
								_t80 = E10023A40();
								continue;
							}
							switch( *((intOrPtr*)(_t80 * 4 +  &M100B45A0))) {
								case 0:
									goto L12;
								case 1:
									__eax = 1;
									asm("movsd xmm0, [ebx+0x10]");
									__edx = __ebx;
									_a4 = 1;
									__eax = 0;
									_a8 = 0;
									__eax = __ebp;
									 *__esp = 1;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 2:
									goto L9;
								case 3:
									_a40 = __ecx;
									__eax = 0x7fffffff;
									_a8 = 0x7fffffff;
									asm("movsd xmm0, [ebx+0x10]");
									asm("movsd [esp], xmm0");
									__eax = L10032F80(0x7fffffff, __ebx, __edi, __esi);
									__ecx = _a40;
									asm("movsd xmm0, [0x100b49f8]");
									_a4 = __eax;
									_a8 = __eax;
									__eax = __ebp;
									 *__esp = __edx;
									__edx = __ebx;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 4:
									__eax = __ebx[0x10];
									__edx = __ecx;
									__eax = E10028BF0(__ebx[0x10], __ecx);
									goto L10;
								case 5:
									__eax = __ebx[0x10];
									__edx = 0;
									_a60 = 0;
									if(__eax == 0) {
										L26:
										 *__esp = __ecx;
										_a40 = __ecx;
										E10011CC0();
										__eax = _a60;
										__ecx = _a40;
										 *__ecx = _a60;
										goto L10;
									}
									_a40 = __ecx;
									__edx = L":=";
									__ecx = 0;
									_a16 = 0;
									__ecx = 0x100b4567;
									_a12 = L":=";
									__edx =  &_a60;
									_a8 = 0x100b4567;
									 *__esp =  &_a60;
									_a4 = __eax;
									__eax = E100118C0();
									__ecx = _a40;
									__edx =  &_a60;
									if(__eax < 0) {
										E10011CC0( &_a60);
										goto L10;
									}
									goto L26;
								case 6:
									goto L10;
								case 7:
									__edx = __ebx[0x10];
									if(__edx == 0) {
										L28:
										__ecx[4] = 0;
										 *__ecx = 0;
										goto L10;
									}
									 *__esp = __edx;
									__eax = 0x100b3bdc;
									_a4 = 0x100b3bdc;
									_a44 = __ecx;
									_a40 = __edx;
									__eax = strcmp(??, ??);
									__edx = _a40;
									__ecx = _a44;
									if(__eax == 0) {
										goto L28;
									} else {
										_a8 = __edx;
										__eax =  &(__ecx[4]);
										_a4 =  &(__ecx[4]);
										 *__esp = __ecx;
										_a40 = __edx;
										__eax = E1002E6E0();
										__edx = _a40;
										if(__eax < 0) {
											_a12 = __edx;
											__eax = "Unable to parse option value \"%s\" as image size\n";
											_a8 = "Unable to parse option value \"%s\" as image size\n";
											__eax = 0x10;
											_a4 = 0x10;
											 *__esp = __ebp;
											__eax = E10023A40();
										}
										goto L10;
									}
								case 8:
									__edx = __ebx[0x10];
									 *__esp = __ecx;
									_a4 = __edx;
									_a40 = __edx;
									__eax = E1002E7A0();
									__edx = _a40;
									if(__eax < 0) {
										_a12 = __edx;
										__ecx = "Unable to parse option value \"%s\" as video rate\n";
										__eax = 0x10;
										_a8 = "Unable to parse option value \"%s\" as video rate\n";
										_a4 = 0x10;
										 *__esp = __ebp;
										__eax = E10023A40();
									}
									goto L10;
								case 9:
									_t93 =  *((intOrPtr*)(_t84 + 0x10));
									if(_t93 == 0) {
										goto L10;
									}
									_a4 = _t93;
									_a12 = _t100;
									_a8 = 0xffffffff;
									 *_t102 = _t90;
									_a40 = _t93;
									_t80 = E1002E900(_t110);
									_t94 = _a40;
									if(_t80 < 0) {
										_a12 = _t94;
										_a8 = "Unable to parse option value \"%s\" as color\n";
										_a4 = 0x10;
										 *_t102 = _t100;
										_t80 = E10023A40();
										goto L10;
									}
									if(_t84 != 0) {
										goto L10;
									}
									goto L8;
								case 0xa:
									_a44 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a40 = __ebx[0x10];
									__eax = E1000D270();
									__eax = _a40;
									if(__eax != 0) {
										_a4 = __eax;
										__ecx = _a44;
										 *__esp = _a44;
										__eax = E1000DD40(__fp0);
									}
									goto L10;
							}
						}
						L12:
						__eax = __ebx[0x10];
						asm("movsd xmm0, [0x100b49f8]");
						__edx = __ebx[0x14];
						 *__esp = 1;
						_a4 = __ebx[0x10];
						__eax = __ebp;
						_a8 = __ebx[0x14];
						__edx = __ebx;
						__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					}
					L8:
					return _t80;
				}
			}

0x1002bc2c
0x1002bc2c
0x1002bc2c
0x1002bc2c
0x1002bc2c
0x1002bc30
0x1002bc30
0x1002bc30
0x1002bc34
0x1002bc37
0x1002bc3a
0x1002bc3e
0x1002bc43
0x1002bc4a
0x1002bc4f
0x1002bc53
0x1002bc60
0x1002bc60
0x1002bc60
0x1002bc65
0x00000000
0x00000000
0x1002bc67
0x1002bbbb
0x1002bbc4
0x00000000
0x1002bbd2
0x1002bbd5
0x1002bbd8
0x1002bbdd
0x1002be90
0x1002be99
0x1002bea2
0x1002bea6
0x1002beaa
0x1002bead
0x00000000
0x1002bead
0x1002bbe3
0x00000000
0x00000000
0x00000000
0x1002bca0
0x1002bca5
0x1002bcaa
0x1002bcac
0x1002bcb0
0x1002bcb2
0x1002bcb6
0x1002bcb8
0x1002bcbf
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bd20
0x1002bd24
0x1002bd29
0x1002bd2d
0x1002bd32
0x1002bd37
0x1002bd3c
0x1002bd40
0x1002bd48
0x1002bd4f
0x1002bd53
0x1002bd55
0x1002bd58
0x1002bd5a
0x00000000
0x00000000
0x1002bd08
0x1002bd0b
0x1002bd0d
0x00000000
0x00000000
0x1002be30
0x1002be33
0x1002be35
0x1002be3b
0x1002be75
0x1002be75
0x1002be78
0x1002be7c
0x1002be81
0x1002be85
0x1002be89
0x00000000
0x1002be89
0x1002be3d
0x1002be41
0x1002be46
0x1002be48
0x1002be4c
0x1002be51
0x1002be55
0x1002be59
0x1002be5d
0x1002be60
0x1002be64
0x1002be69
0x1002be6d
0x1002be73
0x1002bed5
0x00000000
0x1002bed5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bdb0
0x1002bdb5
0x1002bec0
0x1002bec0
0x1002bec7
0x00000000
0x1002bec7
0x1002bdbb
0x1002bdbe
0x1002bdc3
0x1002bdc7
0x1002bdcb
0x1002bdcf
0x1002bdd4
0x1002bdd8
0x1002bdde
0x00000000
0x1002bde4
0x1002bde4
0x1002bde8
0x1002bdeb
0x1002bdef
0x1002bdf2
0x1002bdf6
0x1002bdfb
0x1002be01
0x1002be07
0x1002be0b
0x1002be10
0x1002be14
0x1002be19
0x1002be1d
0x1002be20
0x1002be20
0x00000000
0x1002be01
0x00000000
0x1002bd68
0x1002bd6b
0x1002bd6e
0x1002bd72
0x1002bd76
0x1002bd7b
0x1002bd81
0x1002bd87
0x1002bd8b
0x1002bd90
0x1002bd95
0x1002bd99
0x1002bd9d
0x1002bda0
0x1002bda0
0x00000000
0x00000000
0x1002bbf0
0x1002bbf5
0x00000000
0x00000000
0x1002bbf7
0x1002bc00
0x1002bc04
0x1002bc08
0x1002bc0b
0x1002bc0f
0x1002bc14
0x1002bc1a
0x1002bedf
0x1002beed
0x1002bef1
0x1002bef5
0x1002bef8
0x00000000
0x1002bef8
0x1002bc22
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bcd0
0x1002bcd4
0x1002bcd7
0x1002bcda
0x1002bcde
0x1002bce3
0x1002bce9
0x1002bcef
0x1002bcf3
0x1002bcf7
0x1002bcfa
0x1002bcfa
0x00000000
0x00000000
0x1002bbe3
0x1002bc70
0x1002bc70
0x1002bc73
0x1002bc7b
0x1002bc7e
0x1002bc85
0x1002bc89
0x1002bc8b
0x1002bc8f
0x1002bc91
0x1002bc91
0x1002bc24
0x1002bc2b
0x1002bc2b

APIs

mv_parse_color.MAIN ref: 1002BC0F
mv_freep.MAIN ref: 1002BC3E
mv_strdup.MAIN ref: 1002BC4A

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_channel_layout_uninit.MAIN ref: 1002BCDE
mv_channel_layout_from_string.MAIN ref: 1002BCFA
mv_d2q.MAIN ref: 1002BD37
mv_parse_video_rate.MAIN ref: 1002BD76
mv_log.MAIN ref: 1002BDA0
strcmp.MSVCRT ref: 1002BDCF
mv_parse_video_size.MAIN ref: 1002BDF6
mv_log.MAIN ref: 1002BE20
mv_dict_parse_string.MAIN ref: 1002BE64
mv_dict_free.MAIN ref: 1002BE7C
mv_log.MAIN ref: 1002BEAD

Strings

Unable to parse option value "%s" as image size, xrefs: 1002BE0B
none, xrefs: 1002BDBE
Unable to parse option value "%s" as video rate, xrefs: 1002BD8B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$_aligned_reallocmv_channel_layout_from_stringmv_channel_layout_uninitmv_d2qmv_dict_freemv_dict_parse_stringmv_freepmv_parse_colormv_parse_video_ratemv_parse_video_sizemv_strdupstrcmpstrlen
String ID: Unable to parse option value "%s" as image size$Unable to parse option value "%s" as video rate$none
API String ID: 1619538473-3528850829
Opcode ID: 9c2ea0eeeae0607403668ae349b38f15b41b77572eff6dfabbc8ea3f6034ca98
Instruction ID: e6ef27d6030b1f10d76ee6383097accb3525d37c3e4c22336ff58ecae836fb35
Opcode Fuzzy Hash: 9c2ea0eeeae0607403668ae349b38f15b41b77572eff6dfabbc8ea3f6034ca98
Instruction Fuzzy Hash: F571C4B8608B058FC744DF29E0C061BBBE5FFC8754F65892EF8999B325DA30D9419B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BD04 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1002BD04(void* __ebx, void* __ecx, void* __edi, signed int __esi, char* __ebp, int __fp0, char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a40, char* _a44, char _a60) {
				signed int _t80;
				void* _t84;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t96;
				signed int _t98;
				char* _t100;
				intOrPtr* _t102;
				int _t110;

				_t110 = __fp0;
				_t100 = __ebp;
				_t98 = __esi;
				_t96 = __edi;
				_t84 = __ebx;
				while(1) {
					L16:
					__eax = __ebx[0x10];
					__edx = __ecx;
					__eax = E10028BF0(__ebx[0x10], __ecx);
					while(1) {
						L10:
						_t91 =  *((intOrPtr*)(_t84 + 0x30));
						if(_t91 == 0) {
							break;
						}
						_t84 = _t84 + 0x30;
						_t80 =  *(_t84 + 0x28);
						if((_t80 & _t98) != _t96 || (_t80 & 0x00000080) != 0) {
							continue;
						} else {
							_t80 =  *(_t84 + 0xc);
							_t90 =  *((intOrPtr*)(_t84 + 8)) + _t100;
							if(_t80 > 0x13) {
								_a16 = _t91;
								_a12 = _t80;
								_a8 = "AVOption type %d of option %s not implemented yet\n";
								_a4 = 0x30;
								 *_t102 = _t100;
								_t80 = E10023A40();
								continue;
							}
							switch( *((intOrPtr*)(_t80 * 4 +  &M100B45A0))) {
								case 0:
									goto L12;
								case 1:
									__eax = 1;
									asm("movsd xmm0, [ebx+0x10]");
									__edx = __ebx;
									_a4 = 1;
									__eax = 0;
									_a8 = 0;
									__eax = __ebp;
									 *__esp = 1;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 2:
									_a40 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a44 = __ebx[0x10];
									E100265C0();
									__eax = _a44;
									__eax = E100267C0(__ebx, __edi, __esi, __ebp, _a44);
									__ecx = _a40;
									 *__ecx = __eax;
									goto L10;
								case 3:
									_a40 = __ecx;
									__eax = 0x7fffffff;
									_a8 = 0x7fffffff;
									asm("movsd xmm0, [ebx+0x10]");
									asm("movsd [esp], xmm0");
									__eax = L10032F80(0x7fffffff, __ebx, __edi, __esi);
									__ecx = _a40;
									asm("movsd xmm0, [0x100b49f8]");
									_a4 = __eax;
									_a8 = __eax;
									__eax = __ebp;
									 *__esp = __edx;
									__edx = __ebx;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 4:
									goto L16;
								case 5:
									__eax = __ebx[0x10];
									__edx = 0;
									_a60 = 0;
									if(__eax == 0) {
										L26:
										 *__esp = __ecx;
										_a40 = __ecx;
										E10011CC0();
										__eax = _a60;
										__ecx = _a40;
										 *__ecx = _a60;
										goto L10;
									}
									_a40 = __ecx;
									__edx = L":=";
									__ecx = 0;
									_a16 = 0;
									__ecx = 0x100b4567;
									_a12 = L":=";
									__edx =  &_a60;
									_a8 = 0x100b4567;
									 *__esp =  &_a60;
									_a4 = __eax;
									__eax = E100118C0();
									__ecx = _a40;
									__edx =  &_a60;
									if(__eax < 0) {
										E10011CC0( &_a60);
										goto L10;
									}
									goto L26;
								case 6:
									goto L10;
								case 7:
									__edx = __ebx[0x10];
									if(__edx == 0) {
										L28:
										__ecx[4] = 0;
										 *__ecx = 0;
										goto L10;
									}
									 *__esp = __edx;
									__eax = 0x100b3bdc;
									_a4 = 0x100b3bdc;
									_a44 = __ecx;
									_a40 = __edx;
									__eax = strcmp(??, ??);
									__edx = _a40;
									__ecx = _a44;
									if(__eax == 0) {
										goto L28;
									} else {
										_a8 = __edx;
										__eax =  &(__ecx[4]);
										_a4 =  &(__ecx[4]);
										 *__esp = __ecx;
										_a40 = __edx;
										__eax = E1002E6E0();
										__edx = _a40;
										if(__eax < 0) {
											_a12 = __edx;
											__eax = "Unable to parse option value \"%s\" as image size\n";
											_a8 = "Unable to parse option value \"%s\" as image size\n";
											__eax = 0x10;
											_a4 = 0x10;
											 *__esp = __ebp;
											__eax = E10023A40();
										}
										goto L10;
									}
								case 8:
									__edx = __ebx[0x10];
									 *__esp = __ecx;
									_a4 = __edx;
									_a40 = __edx;
									__eax = E1002E7A0();
									__edx = _a40;
									if(__eax < 0) {
										_a12 = __edx;
										__ecx = "Unable to parse option value \"%s\" as video rate\n";
										__eax = 0x10;
										_a8 = "Unable to parse option value \"%s\" as video rate\n";
										_a4 = 0x10;
										 *__esp = __ebp;
										__eax = E10023A40();
									}
									goto L10;
								case 9:
									_t93 =  *((intOrPtr*)(_t84 + 0x10));
									if(_t93 == 0) {
										goto L10;
									}
									_a4 = _t93;
									_a12 = _t100;
									_a8 = 0xffffffff;
									 *_t102 = _t90;
									_a40 = _t93;
									_t80 = E1002E900(_t110);
									_t94 = _a40;
									if(_t80 < 0) {
										_a12 = _t94;
										_a8 = "Unable to parse option value \"%s\" as color\n";
										_a4 = 0x10;
										 *_t102 = _t100;
										_t80 = E10023A40();
										goto L10;
									}
									if(_t84 != 0) {
										goto L10;
									}
									goto L8;
								case 0xa:
									_a44 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a40 = __ebx[0x10];
									__eax = E1000D270();
									__eax = _a40;
									if(__eax != 0) {
										_a4 = __eax;
										__ecx = _a44;
										 *__esp = _a44;
										__eax = E1000DD40(__fp0);
									}
									goto L10;
							}
						}
						L12:
						__eax = __ebx[0x10];
						asm("movsd xmm0, [0x100b49f8]");
						__edx = __ebx[0x14];
						 *__esp = 1;
						_a4 = __ebx[0x10];
						__eax = __ebp;
						_a8 = __ebx[0x14];
						__edx = __ebx;
						__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					}
					L8:
					return _t80;
				}
			}

0x1002bd04
0x1002bd04
0x1002bd04
0x1002bd04
0x1002bd04
0x1002bd08
0x1002bd08
0x1002bd08
0x1002bd0b
0x1002bd0d
0x1002bc60
0x1002bc60
0x1002bc60
0x1002bc65
0x00000000
0x00000000
0x1002bc67
0x1002bbbb
0x1002bbc4
0x00000000
0x1002bbd2
0x1002bbd5
0x1002bbd8
0x1002bbdd
0x1002be90
0x1002be99
0x1002bea2
0x1002bea6
0x1002beaa
0x1002bead
0x00000000
0x1002bead
0x1002bbe3
0x00000000
0x00000000
0x00000000
0x1002bca0
0x1002bca5
0x1002bcaa
0x1002bcac
0x1002bcb0
0x1002bcb2
0x1002bcb6
0x1002bcb8
0x1002bcbf
0x00000000
0x00000000
0x1002bc30
0x1002bc34
0x1002bc37
0x1002bc3a
0x1002bc3e
0x1002bc43
0x1002bc4a
0x1002bc4f
0x1002bc53
0x00000000
0x00000000
0x1002bd20
0x1002bd24
0x1002bd29
0x1002bd2d
0x1002bd32
0x1002bd37
0x1002bd3c
0x1002bd40
0x1002bd48
0x1002bd4f
0x1002bd53
0x1002bd55
0x1002bd58
0x1002bd5a
0x00000000
0x00000000
0x00000000
0x00000000
0x1002be30
0x1002be33
0x1002be35
0x1002be3b
0x1002be75
0x1002be75
0x1002be78
0x1002be7c
0x1002be81
0x1002be85
0x1002be89
0x00000000
0x1002be89
0x1002be3d
0x1002be41
0x1002be46
0x1002be48
0x1002be4c
0x1002be51
0x1002be55
0x1002be59
0x1002be5d
0x1002be60
0x1002be64
0x1002be69
0x1002be6d
0x1002be73
0x1002bed5
0x00000000
0x1002bed5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bdb0
0x1002bdb5
0x1002bec0
0x1002bec0
0x1002bec7
0x00000000
0x1002bec7
0x1002bdbb
0x1002bdbe
0x1002bdc3
0x1002bdc7
0x1002bdcb
0x1002bdcf
0x1002bdd4
0x1002bdd8
0x1002bdde
0x00000000
0x1002bde4
0x1002bde4
0x1002bde8
0x1002bdeb
0x1002bdef
0x1002bdf2
0x1002bdf6
0x1002bdfb
0x1002be01
0x1002be07
0x1002be0b
0x1002be10
0x1002be14
0x1002be19
0x1002be1d
0x1002be20
0x1002be20
0x00000000
0x1002be01
0x00000000
0x1002bd68
0x1002bd6b
0x1002bd6e
0x1002bd72
0x1002bd76
0x1002bd7b
0x1002bd81
0x1002bd87
0x1002bd8b
0x1002bd90
0x1002bd95
0x1002bd99
0x1002bd9d
0x1002bda0
0x1002bda0
0x00000000
0x00000000
0x1002bbf0
0x1002bbf5
0x00000000
0x00000000
0x1002bbf7
0x1002bc00
0x1002bc04
0x1002bc08
0x1002bc0b
0x1002bc0f
0x1002bc14
0x1002bc1a
0x1002bedf
0x1002beed
0x1002bef1
0x1002bef5
0x1002bef8
0x00000000
0x1002bef8
0x1002bc22
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bcd0
0x1002bcd4
0x1002bcd7
0x1002bcda
0x1002bcde
0x1002bce3
0x1002bce9
0x1002bcef
0x1002bcf3
0x1002bcf7
0x1002bcfa
0x1002bcfa
0x00000000
0x00000000
0x1002bbe3
0x1002bc70
0x1002bc70
0x1002bc73
0x1002bc7b
0x1002bc7e
0x1002bc85
0x1002bc89
0x1002bc8b
0x1002bc8f
0x1002bc91
0x1002bc91
0x1002bc24
0x1002bc2b
0x1002bc2b

APIs

Part of subcall function 10028BF0: mv_freep.MAIN ref: 10028BFE
Part of subcall function 10028BF0: strlen.MSVCRT ref: 10028C15
Part of subcall function 10028BF0: mv_malloc.MAIN ref: 10028C31

mv_parse_color.MAIN ref: 1002BC0F
mv_freep.MAIN ref: 1002BC3E
mv_strdup.MAIN ref: 1002BC4A
mv_channel_layout_uninit.MAIN ref: 1002BCDE
mv_channel_layout_from_string.MAIN ref: 1002BCFA
mv_d2q.MAIN ref: 1002BD37
mv_parse_video_rate.MAIN ref: 1002BD76
mv_log.MAIN ref: 1002BDA0
strcmp.MSVCRT ref: 1002BDCF
mv_parse_video_size.MAIN ref: 1002BDF6
mv_log.MAIN ref: 1002BE20
mv_dict_parse_string.MAIN ref: 1002BE64
mv_dict_free.MAIN ref: 1002BE7C
mv_log.MAIN ref: 1002BEAD

Strings

Unable to parse option value "%s" as image size, xrefs: 1002BE0B
none, xrefs: 1002BDBE
Unable to parse option value "%s" as video rate, xrefs: 1002BD8B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_freep$mv_channel_layout_from_stringmv_channel_layout_uninitmv_d2qmv_dict_freemv_dict_parse_stringmv_mallocmv_parse_colormv_parse_video_ratemv_parse_video_sizemv_strdupstrcmpstrlen
String ID: Unable to parse option value "%s" as image size$Unable to parse option value "%s" as video rate$none
API String ID: 1160367768-3528850829
Opcode ID: fe0f56bc99329f4fd92de954fa45c6945f7cb41cceaef66ca2702aa210788be1
Instruction ID: 51188ab3c7a2d508b56567014233501483306943bfa059965a9b6946081112cf
Opcode Fuzzy Hash: fe0f56bc99329f4fd92de954fa45c6945f7cb41cceaef66ca2702aa210788be1
Instruction Fuzzy Hash: 0671C4B8608B058FC744DF29E0C061BBBE5FFC8754F65892EF8999B325DA30D9419B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BD64 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1002BD64(void* __ebx, void* __ecx, void* __edi, signed int __esi, char* __ebp, int __fp0, char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a40, char* _a44, char* _a60) {
				signed int _t80;
				void* _t84;
				intOrPtr _t90;
				intOrPtr _t91;
				void* _t96;
				signed int _t98;
				char* _t100;
				intOrPtr* _t102;
				int _t110;

				_t110 = __fp0;
				_t100 = __ebp;
				_t98 = __esi;
				_t96 = __edi;
				_t84 = __ebx;
				while(1) {
					L18:
					__edx = __ebx[0x10];
					 *__esp = __ecx;
					_a4 = __edx;
					_a40 = __edx;
					__eax = E1002E7A0();
					__edx = _a40;
					if(__eax < 0) {
						_a12 = __edx;
						__ecx = "Unable to parse option value \"%s\" as video rate\n";
						__eax = 0x10;
						_a8 = "Unable to parse option value \"%s\" as video rate\n";
						_a4 = 0x10;
						 *__esp = __ebp;
						__eax = E10023A40();
					}
					while(1) {
						L10:
						_t91 =  *((intOrPtr*)(_t84 + 0x30));
						if(_t91 == 0) {
							break;
						}
						_t84 = _t84 + 0x30;
						_t80 =  *(_t84 + 0x28);
						if((_t80 & _t98) != _t96 || (_t80 & 0x00000080) != 0) {
							continue;
						} else {
							_t80 =  *(_t84 + 0xc);
							_t90 =  *((intOrPtr*)(_t84 + 8)) + _t100;
							if(_t80 > 0x13) {
								_a16 = _t91;
								_a12 = _t80;
								_a8 = "AVOption type %d of option %s not implemented yet\n";
								_a4 = 0x30;
								 *_t102 = _t100;
								_t80 = E10023A40();
								continue;
							}
							switch( *((intOrPtr*)(_t80 * 4 +  &M100B45A0))) {
								case 0:
									goto L12;
								case 1:
									__eax = 1;
									asm("movsd xmm0, [ebx+0x10]");
									__edx = __ebx;
									_a4 = 1;
									__eax = 0;
									_a8 = 0;
									__eax = __ebp;
									 *__esp = 1;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 2:
									_a40 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a44 = __ebx[0x10];
									E100265C0();
									__eax = _a44;
									__eax = E100267C0(__ebx, __edi, __esi, __ebp, _a44);
									__ecx = _a40;
									 *__ecx = __eax;
									goto L10;
								case 3:
									_a40 = __ecx;
									__eax = 0x7fffffff;
									_a8 = 0x7fffffff;
									asm("movsd xmm0, [ebx+0x10]");
									asm("movsd [esp], xmm0");
									__eax = L10032F80(0x7fffffff, __ebx, __edi, __esi);
									__ecx = _a40;
									asm("movsd xmm0, [0x100b49f8]");
									_a4 = __eax;
									_a8 = __eax;
									__eax = __ebp;
									 *__esp = __edx;
									__edx = __ebx;
									__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
									goto L10;
								case 4:
									__eax = __ebx[0x10];
									__edx = __ecx;
									__eax = E10028BF0(__ebx[0x10], __ecx);
									goto L10;
								case 5:
									__eax = __ebx[0x10];
									__edx = 0;
									_a60 = 0;
									if(__eax == 0) {
										L26:
										 *__esp = __ecx;
										_a40 = __ecx;
										E10011CC0();
										__eax = _a60;
										__ecx = _a40;
										 *__ecx = _a60;
										goto L10;
									}
									_a40 = __ecx;
									__edx = L":=";
									__ecx = 0;
									_a16 = 0;
									__ecx = 0x100b4567;
									_a12 = L":=";
									__edx =  &_a60;
									_a8 = 0x100b4567;
									 *__esp =  &_a60;
									_a4 = __eax;
									__eax = E100118C0();
									__ecx = _a40;
									__edx =  &_a60;
									if(__eax < 0) {
										E10011CC0( &_a60);
										goto L10;
									}
									goto L26;
								case 6:
									goto L10;
								case 7:
									__edx = __ebx[0x10];
									if(__edx == 0) {
										L28:
										__ecx[4] = 0;
										 *__ecx = 0;
										goto L10;
									}
									 *__esp = __edx;
									__eax = 0x100b3bdc;
									_a4 = 0x100b3bdc;
									_a44 = __ecx;
									_a40 = __edx;
									__eax = strcmp(??, ??);
									__edx = _a40;
									__ecx = _a44;
									if(__eax == 0) {
										goto L28;
									} else {
										_a8 = __edx;
										__eax =  &(__ecx[4]);
										_a4 =  &(__ecx[4]);
										 *__esp = __ecx;
										_a40 = __edx;
										__eax = E1002E6E0();
										__edx = _a40;
										if(__eax < 0) {
											_a12 = __edx;
											__eax = "Unable to parse option value \"%s\" as image size\n";
											_a8 = "Unable to parse option value \"%s\" as image size\n";
											__eax = 0x10;
											_a4 = 0x10;
											 *__esp = __ebp;
											__eax = E10023A40();
										}
										goto L10;
									}
								case 8:
									goto L18;
								case 9:
									_t93 =  *((intOrPtr*)(_t84 + 0x10));
									if(_t93 == 0) {
										goto L10;
									}
									_a4 = _t93;
									_a12 = _t100;
									_a8 = 0xffffffff;
									 *_t102 = _t90;
									_a40 = _t93;
									_t80 = E1002E900(_t110);
									_t94 = _a40;
									if(_t80 < 0) {
										_a12 = _t94;
										_a8 = "Unable to parse option value \"%s\" as color\n";
										_a4 = 0x10;
										 *_t102 = _t100;
										_t80 = E10023A40();
										goto L10;
									}
									if(_t84 != 0) {
										goto L10;
									}
									goto L8;
								case 0xa:
									_a44 = __ecx;
									__eax = __ebx[0x10];
									 *__esp = __ecx;
									_a40 = __ebx[0x10];
									__eax = E1000D270();
									__eax = _a40;
									if(__eax != 0) {
										_a4 = __eax;
										__ecx = _a44;
										 *__esp = _a44;
										__eax = E1000DD40(__fp0);
									}
									goto L10;
							}
						}
						L12:
						__eax = __ebx[0x10];
						asm("movsd xmm0, [0x100b49f8]");
						__edx = __ebx[0x14];
						 *__esp = 1;
						_a4 = __ebx[0x10];
						__eax = __ebp;
						_a8 = __ebx[0x14];
						__edx = __ebx;
						__eax = E100281D0(__ebx, __ecx, __ebx, __edi, __esi, __fp0);
					}
					L8:
					return _t80;
				}
			}

0x1002bd64
0x1002bd64
0x1002bd64
0x1002bd64
0x1002bd64
0x1002bd68
0x1002bd68
0x1002bd68
0x1002bd6b
0x1002bd6e
0x1002bd72
0x1002bd76
0x1002bd7b
0x1002bd81
0x1002bd87
0x1002bd8b
0x1002bd90
0x1002bd95
0x1002bd99
0x1002bd9d
0x1002bda0
0x1002bda0
0x1002bc60
0x1002bc60
0x1002bc60
0x1002bc65
0x00000000
0x00000000
0x1002bc67
0x1002bbbb
0x1002bbc4
0x00000000
0x1002bbd2
0x1002bbd5
0x1002bbd8
0x1002bbdd
0x1002be90
0x1002be99
0x1002bea2
0x1002bea6
0x1002beaa
0x1002bead
0x00000000
0x1002bead
0x1002bbe3
0x00000000
0x00000000
0x00000000
0x1002bca0
0x1002bca5
0x1002bcaa
0x1002bcac
0x1002bcb0
0x1002bcb2
0x1002bcb6
0x1002bcb8
0x1002bcbf
0x00000000
0x00000000
0x1002bc30
0x1002bc34
0x1002bc37
0x1002bc3a
0x1002bc3e
0x1002bc43
0x1002bc4a
0x1002bc4f
0x1002bc53
0x00000000
0x00000000
0x1002bd20
0x1002bd24
0x1002bd29
0x1002bd2d
0x1002bd32
0x1002bd37
0x1002bd3c
0x1002bd40
0x1002bd48
0x1002bd4f
0x1002bd53
0x1002bd55
0x1002bd58
0x1002bd5a
0x00000000
0x00000000
0x1002bd08
0x1002bd0b
0x1002bd0d
0x00000000
0x00000000
0x1002be30
0x1002be33
0x1002be35
0x1002be3b
0x1002be75
0x1002be75
0x1002be78
0x1002be7c
0x1002be81
0x1002be85
0x1002be89
0x00000000
0x1002be89
0x1002be3d
0x1002be41
0x1002be46
0x1002be48
0x1002be4c
0x1002be51
0x1002be55
0x1002be59
0x1002be5d
0x1002be60
0x1002be64
0x1002be69
0x1002be6d
0x1002be73
0x1002bed5
0x00000000
0x1002bed5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bdb0
0x1002bdb5
0x1002bec0
0x1002bec0
0x1002bec7
0x00000000
0x1002bec7
0x1002bdbb
0x1002bdbe
0x1002bdc3
0x1002bdc7
0x1002bdcb
0x1002bdcf
0x1002bdd4
0x1002bdd8
0x1002bdde
0x00000000
0x1002bde4
0x1002bde4
0x1002bde8
0x1002bdeb
0x1002bdef
0x1002bdf2
0x1002bdf6
0x1002bdfb
0x1002be01
0x1002be07
0x1002be0b
0x1002be10
0x1002be14
0x1002be19
0x1002be1d
0x1002be20
0x1002be20
0x00000000
0x1002be01
0x00000000
0x00000000
0x00000000
0x1002bbf0
0x1002bbf5
0x00000000
0x00000000
0x1002bbf7
0x1002bc00
0x1002bc04
0x1002bc08
0x1002bc0b
0x1002bc0f
0x1002bc14
0x1002bc1a
0x1002bedf
0x1002beed
0x1002bef1
0x1002bef5
0x1002bef8
0x00000000
0x1002bef8
0x1002bc22
0x00000000
0x00000000
0x00000000
0x00000000
0x1002bcd0
0x1002bcd4
0x1002bcd7
0x1002bcda
0x1002bcde
0x1002bce3
0x1002bce9
0x1002bcef
0x1002bcf3
0x1002bcf7
0x1002bcfa
0x1002bcfa
0x00000000
0x00000000
0x1002bbe3
0x1002bc70
0x1002bc70
0x1002bc73
0x1002bc7b
0x1002bc7e
0x1002bc85
0x1002bc89
0x1002bc8b
0x1002bc8f
0x1002bc91
0x1002bc91
0x1002bc24
0x1002bc2b
0x1002bc2b

APIs

mv_parse_video_rate.MAIN ref: 1002BD76

Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E7B8
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E7D0
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E7E8
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E800
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E818
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E830
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E848
Part of subcall function 1002E7A0: strcmp.MSVCRT ref: 1002E860
Part of subcall function 1002E7A0: mv_parse_ratio.MAIN(?,?,?,?,?,?,?,?,1002BD7B), ref: 1002E88C

mv_log.MAIN ref: 1002BDA0

Strings

Unable to parse option value "%s" as image size, xrefs: 1002BE0B
none, xrefs: 1002BDBE
Unable to parse option value "%s" as video rate, xrefs: 1002BD8B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_logmv_parse_ratiomv_parse_video_rate
String ID: Unable to parse option value "%s" as image size$Unable to parse option value "%s" as video rate$none
API String ID: 3172953258-3528850829
Opcode ID: 380891216485b06732b3b7443e6e022311ecc765c214d0da3ea0cc54e37fd0a5
Instruction ID: af771b4d78129ed0b18cce80eaecda5f08b7ff5e3aabdee9e1ebb9873735c528
Opcode Fuzzy Hash: 380891216485b06732b3b7443e6e022311ecc765c214d0da3ea0cc54e37fd0a5
Instruction Fuzzy Hash: DD71C4B8608B058FC744DF29E0C061BBBE5FFC8754F65892EF8999B325DA30D9419B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002D230 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 128stringCOMMON

Download Yara Rule

APIs

mv_get_token.MAIN ref: 1002D267

Part of subcall function 10006940: strlen.MSVCRT ref: 10006950
Part of subcall function 10006940: mv_malloc.MAIN ref: 10006959
Part of subcall function 10006940: strspn.MSVCRT ref: 10006980
Part of subcall function 10006940: strspn.MSVCRT ref: 100069C1

strspn.MSVCRT ref: 1002D292
mv_get_token.MAIN ref: 1002D2B5
mv_log.MAIN ref: 1002D2E5
mv_opt_set.MAIN ref: 1002D302
mv_log.MAIN ref: 1002D379
mv_log.MAIN ref: 1002D3C9
mv_freep.MAIN ref: 1002D3EE

Strings

Setting entry with key '%s' to value '%s', xrefs: 1002D2CC
Key '%s' not found., xrefs: 1002D364
Missing key or no key/value separator found after key '%s', xrefs: 1002D3B4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_logstrspn$mv_get_token$mv_freepmv_mallocmv_opt_setstrlen
String ID: Key '%s' not found.$Missing key or no key/value separator found after key '%s'$Setting entry with key '%s' to value '%s'
API String ID: 3679258194-2858522012
Opcode ID: 595c6547f65cc4bb8e71bd801e19b34be3a319f29eb8b0681d307362fd9c2fa6
Instruction ID: 7fb14f7b88a9286a04fbc63168e79df0a13211f554c8c21c667f0136fc5f52d7
Opcode Fuzzy Hash: 595c6547f65cc4bb8e71bd801e19b34be3a319f29eb8b0681d307362fd9c2fa6
Instruction Fuzzy Hash: 5B41D2B4A097409FC340EF29E48061EBBE4FF88394F91892EF5C887351EA75D940CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10015D21 Relevance: 27.1, APIs: 18, Instructions: 116COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 10015D33
mv_expr_free.MAIN ref: 10015DA4
mv_expr_free.MAIN ref: 10015DB3
mv_expr_free.MAIN ref: 10015DC2
mv_freep.MAIN ref: 10015DD1
mv_freep.MAIN ref: 10015DDD
mv_expr_free.MAIN ref: 10015DFF
mv_expr_free.MAIN ref: 10015E0E
mv_expr_free.MAIN ref: 10015E1D
mv_freep.MAIN ref: 10015E2C
mv_freep.MAIN ref: 10015E38
mv_expr_free.MAIN ref: 10015E5A
mv_expr_free.MAIN ref: 10015E69
mv_expr_free.MAIN ref: 10015E78
mv_freep.MAIN ref: 10015E87
mv_freep.MAIN ref: 10015E93
mv_freep.MAIN ref: 10015EAA
mv_freep.MAIN ref: 10015EB6
mv_expr_free.MAIN ref: 10015EE9
mv_expr_free.MAIN ref: 10015EF8
mv_expr_free.MAIN ref: 10015F07
mv_freep.MAIN ref: 10015F16
mv_freep.MAIN ref: 10015F22
mv_expr_free.MAIN ref: 10015F35
mv_expr_free.MAIN ref: 10015F44
mv_expr_free.MAIN ref: 10015F53
mv_freep.MAIN ref: 10015F62
mv_freep.MAIN ref: 10015F6E

Part of subcall function 10015A2B: mv_mallocz.MAIN ref: 10015A99

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_free$mv_freep$mv_mallocz
String ID:
API String ID: 83030161-0
Opcode ID: a0422060849ebd637ef2a0d2a2ce0fd25ceb23375c84b6397d6fd720fbb01da2
Instruction ID: d9cbd58b734f287e56269df78d32147e0427977db120660ed9c5c0a17353d80e
Opcode Fuzzy Hash: a0422060849ebd637ef2a0d2a2ce0fd25ceb23375c84b6397d6fd720fbb01da2
Instruction Fuzzy Hash: 37518EB8508711CFC344EF64C08151ABBE1FF88315F558A5EE8985B309D736EA868F82

Uniqueness

Uniqueness Score: -1.00%

Function 1002D400 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1002D46B
mv_opt_set.MAIN ref: 1002D488
mv_opt_get_key_value.MAIN ref: 1002D4F6

Part of subcall function 1002BF30: strspn.MSVCRT ref: 1002BF4D
Part of subcall function 1002BF30: strspn.MSVCRT ref: 1002BF97
Part of subcall function 1002BF30: strchr.MSVCRT ref: 1002BFB5
Part of subcall function 1002BF30: mv_malloc.MAIN(?,?,?,?,?,?,?,?,?,?,100AEACF,100AEB86,00000000,?,1000DF13), ref: 1002BFCD
Part of subcall function 1002BF30: mv_get_token.MAIN ref: 1002BFFF

mv_strerror.MAIN ref: 1002D5A9
mv_log.MAIN ref: 1002D5D2
mv_log.MAIN ref: 1002D615
mv_log.MAIN ref: 1002D653

Strings

Setting '%s' to value '%s', xrefs: 1002D44C
Unable to parse '%s': %s, xrefs: 1002D5AE
Option '%s' not found, xrefs: 1002D637
No option name near '%s', xrefs: 1002D600

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$strspn$mv_get_tokenmv_mallocmv_opt_get_key_valuemv_opt_setmv_strerrorstrchr
String ID: No option name near '%s'$Option '%s' not found$Setting '%s' to value '%s'$Unable to parse '%s': %s
API String ID: 669169455-2003673103
Opcode ID: 42f4af90029895782656a055397532cb0e26e144a9066ca91bb51c1471e1f9dd
Instruction ID: 701acf41a1ead03db3666d664b3341f8442fad518a1ed00e3a98405c4d1a9712
Opcode Fuzzy Hash: 42f4af90029895782656a055397532cb0e26e144a9066ca91bb51c1471e1f9dd
Instruction Fuzzy Hash: 5C51F575A087509FD760EF29E48075EBBE4EFC4654F91882EE9C9C7341E774E8408B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004C6B7 Relevance: 25.9, APIs: 17, Instructions: 379COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C757
mv_tree_find.MAIN ref: 1004C776
mv_tree_find.MAIN ref: 1004C7EF
mv_tree_find.MAIN ref: 1004C80E
mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: a2a5cd09734139798f1fd845032fbc4d271d5e899faa0ed1a3b262cc80cb7db8
Instruction ID: cce57886af535d8735bdf396c26f78100a8d8e3b141664cbd45599b0a5c3ab2e
Opcode Fuzzy Hash: a2a5cd09734139798f1fd845032fbc4d271d5e899faa0ed1a3b262cc80cb7db8
Instruction Fuzzy Hash: 4FF1AFB490974A9FC344DF2AC18091AFBE5FFC8654F61892EE888D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1004C704 Relevance: 25.9, APIs: 17, Instructions: 363COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C757
mv_tree_find.MAIN ref: 1004C776
mv_tree_find.MAIN ref: 1004C7EF
mv_tree_find.MAIN ref: 1004C80E
mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: 2e39002f0947aa2d0dcfdfe7d57795e1a31c696425fd7e0b4506f071d05121fc
Instruction ID: 7ec3c2c7dacb140ed4bfedfc7a75d038d4e13e51791f240047a25a975b8cf788
Opcode Fuzzy Hash: 2e39002f0947aa2d0dcfdfe7d57795e1a31c696425fd7e0b4506f071d05121fc
Instruction Fuzzy Hash: 73F1A0B490974A9FC344DF2AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1001E0B0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E1001E0B0(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t213;
				signed int _t214;
				intOrPtr _t215;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				signed int _t224;
				signed int _t227;
				signed int _t228;
				signed int _t230;
				signed int _t247;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t257;
				void* _t258;
				void* _t259;
				signed int _t261;
				void* _t262;
				void* _t263;
				signed char _t267;
				signed int _t268;
				signed int _t269;
				signed int _t273;
				intOrPtr _t275;
				intOrPtr _t280;
				signed int _t281;
				signed int _t282;
				signed int _t283;
				intOrPtr _t289;
				signed int _t291;
				signed int _t297;
				signed int _t300;
				signed int _t302;
				signed int _t304;
				signed short* _t309;
				signed short* _t310;
				int _t314;
				signed int _t324;
				intOrPtr* _t326;
				intOrPtr _t327;
				signed char _t335;
				short* _t336;
				signed char _t337;
				short* _t338;
				signed int _t339;
				signed int _t341;
				char* _t343;
				signed int _t345;
				signed int _t347;
				signed int _t349;
				signed int _t352;
				void* _t353;
				void* _t356;
				signed int _t362;
				signed int _t364;
				signed int _t368;
				signed int _t370;
				signed int _t373;
				signed short* _t374;
				signed short* _t375;
				signed int _t376;
				void* _t378;
				signed int _t381;
				intOrPtr _t382;
				signed int _t383;
				signed int _t385;
				signed int _t388;
				void* _t389;
				intOrPtr* _t390;
				signed int* _t392;
				signed int* _t396;

				_t390 = _t389 - 0x4c;
				 *((intOrPtr*)(_t390 + 0x44)) = __edi;
				 *((intOrPtr*)(_t390 + 0x3c)) = __ebx;
				_t343 =  *(_t390 + 0x54);
				 *((intOrPtr*)(_t390 + 0x48)) = _t382;
				_t289 =  *((intOrPtr*)(_t390 + 0x50));
				 *((intOrPtr*)(_t390 + 0x40)) = __esi;
				 *(_t390 + 0x28) =  *(_t390 + 0x58);
				_t383 =  *(_t289 + 0x50);
				_t362 =  *(_t289 + 0x128);
				 *(_t390 + 0x24) = _t383;
				if(_t343[0x128] == 0) {
					_t213 = _t362;
					goto L83;
				} else {
					__eflags = __esi;
					__edx =  *(__eax + 4);
					if(__esi == 0) {
						__eax = __edi[0x50];
						__eflags =  *((intOrPtr*)(__edx + 0x24)) - __edi[0x50];
						if( *((intOrPtr*)(__edx + 0x24)) != __edi[0x50]) {
							goto L91;
						} else {
							 *(__edx + 4) =  *( *(__edx + 4));
							__eax =  *( *( *(__edx + 4)) + 0x50);
							__eflags = __eax;
							if(__eax == 0) {
								goto L91;
							} else {
								goto L79;
							}
						}
					} else {
						__eax =  *(__esi + 4);
						__eflags = __eax - __edx;
						if(__eax == __edx) {
							__ecx =  *(__eax + 0x28);
							__eflags = __edi[0x50] -  *(__eax + 0x28);
							if(__edi[0x50] !=  *(__eax + 0x28)) {
								goto L66;
							} else {
								__eflags =  *((intOrPtr*)(__eax + 0x24)) - __ebp;
								if( *((intOrPtr*)(__eax + 0x24)) != __ebp) {
									goto L66;
								} else {
									goto L89;
								}
							}
						} else {
							L66:
							__ecx =  *(__edx + 4);
							__esp[0xb] = __ecx;
							__ecx = __ecx[0xc];
							__eflags = __ecx;
							if(__ecx == 0) {
								L68:
								__ecx = __edi[0x50];
								__eflags =  *((intOrPtr*)(__edx + 0x24)) - __edi[0x50];
								if( *((intOrPtr*)(__edx + 0x24)) == __edi[0x50]) {
									__esp[0xb] =  *(__esp[0xb]);
									__eax =  *( *(__esp[0xb]) + 0x50);
									__eflags = __eax;
									if(__eax != 0) {
										L79:
										__esp[2] = __edi;
										__ecx = __esp[0xa];
										__esp[1] = __ebx;
										 *__esp = __edx;
										__esp[3] = __esp[0xa];
										__eax =  *__eax();
										__eflags = __eax;
										if(__eax >= 0) {
											goto L76;
										} else {
											__eflags = __eax - 0xffffffd8;
											if(__eax != 0xffffffd8) {
												goto L73;
											} else {
												__eax =  *(__ebx + 0x128);
												L83:
												__eflags = _t213;
												if(_t213 == 0) {
													goto L91;
												} else {
													 *(_t390 + 0x24) =  *(_t289 + 0x50);
													goto L85;
												}
											}
										}
									} else {
										__eax = __esi;
										L85:
										_t215 =  *((intOrPtr*)(_t213 + 4));
										goto L69;
									}
								} else {
									L69:
									__eflags =  *((intOrPtr*)(_t215 + 0x24)) -  *(_t390 + 0x24);
									if( *((intOrPtr*)(_t215 + 0x24)) !=  *(_t390 + 0x24)) {
										L91:
										_t214 = 0xffffffd8;
										goto L76;
									} else {
										_t324 =  *( *((intOrPtr*)( *((intOrPtr*)(_t215 + 4)))) + 0x4c);
										__eflags = _t324;
										if(_t324 == 0) {
											goto L91;
										} else {
											 *(_t390 + 8) = _t343;
											 *((intOrPtr*)(_t390 + 4)) = _t289;
											 *_t390 = _t215;
											 *(_t390 + 0xc) =  *(_t390 + 0x28);
											_t214 =  *_t324();
											__eflags = _t214;
											if(_t214 >= 0) {
												goto L76;
											} else {
												__eflags = _t214 - 0xffffffd8;
												if(_t214 == 0xffffffd8) {
													goto L91;
												} else {
													L73:
													__eflags = _t362;
													if(_t362 == 0) {
														L75:
														 *(_t390 + 0x24) = _t214;
														__eflags = 0;
														 *(_t289 + 0x128) = 0;
														 *_t390 = _t289;
														E1001B300();
														_t214 =  *(_t390 + 0x24);
														 *(_t289 + 0x128) = _t362;
														 *(_t289 + 0x50) = _t383;
														goto L76;
													} else {
														__eflags =  *(_t289 + 0x128) - _t362;
														if( *(_t289 + 0x128) != _t362) {
															 *((intOrPtr*)(_t390 + 0x14)) = 0x358;
															__eflags = 0;
															 *((intOrPtr*)(_t390 + 4)) = 0;
															 *_t390 = 0;
															 *(_t390 + 0x10) = "libavutil/hwcontext.c";
															 *(_t390 + 0xc) = "orig_dst_frames == ((void *)0) || orig_dst_frames == dst->hw_frames_ctx";
															 *(_t390 + 8) = "Assertion %s failed at %s:%d\n";
															E10023A40();
															abort();
															_push(_t362);
															_push(_t289);
															_t392 = _t390 - 0x34;
															_t219 = _t392[0x10];
															_t291 = _t392[0x11];
															_t364 =  *(_t219 + 4);
															_t326 =  *((intOrPtr*)(_t364 + 4));
															_t306 =  *(_t326 + 0xc);
															__eflags =  *(_t326 + 0xc);
															if( *(_t326 + 0xc) == 0) {
																_t327 =  *_t326;
																_t307 =  *(_t327 + 0x3c);
																__eflags =  *(_t327 + 0x3c);
																if( *(_t327 + 0x3c) == 0) {
																	_t220 = 0xffffffd8;
																	goto L103;
																} else {
																	__eflags =  *(_t364 + 0x1c);
																	if( *(_t364 + 0x1c) == 0) {
																		_t220 = 0xffffffea;
																		goto L103;
																	} else {
																		 *_t392 = _t219;
																		_t221 = L10009FC0(_t291, _t307);
																		 *(_t291 + 0x128) = _t221;
																		__eflags = _t221;
																		if(_t221 == 0) {
																			goto L102;
																		} else {
																			_t392[1] = _t291;
																			 *_t392 = _t364;
																			_t224 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t364 + 4)))) + 0x3c))();
																			__eflags = _t224;
																			if(_t224 < 0) {
																				_t392[7] = _t224;
																				 *_t392 = _t291 + 0x128;
																				E1000A000(_t291 + 0x128, _t364);
																				_t220 = _t392[7];
																				goto L103;
																			} else {
																				 *(_t291 + 0x40) = _t291;
																				__eflags = 0;
																				return 0;
																			}
																		}
																	}
																}
															} else {
																 *((intOrPtr*)(_t291 + 0x50)) =  *((intOrPtr*)(_t364 + 0x24));
																 *_t392 = _t219;
																_t227 = L10009FC0(_t291, _t306);
																 *(_t291 + 0x128) = _t227;
																__eflags = _t227;
																if(_t227 == 0) {
																	L102:
																	_t220 = 0xfffffff4;
																	goto L103;
																} else {
																	_t228 = E1001AC40(_t291, _t343, _t364);
																	_t392[0xb] = _t228;
																	__eflags = _t228;
																	if(_t228 == 0) {
																		goto L102;
																	} else {
																		_t392[1] = _t228;
																		_t392[2] = 0;
																		_t230 =  *( *((intOrPtr*)(_t364 + 4)) + 0xc);
																		 *_t392 = _t230;
																		L96();
																		__eflags = _t230;
																		if(_t230 < 0) {
																			L109:
																			_t392[7] = _t230;
																			 *_t392 =  &(_t392[0xb]);
																			L1001ADB0(_t291);
																			return _t392[7];
																		} else {
																			 *_t392 = _t291;
																			_t392[2] =  *( *((intOrPtr*)(_t364 + 4)) + 0x10);
																			_t392[1] = _t392[0xb];
																			_t230 = E1001E0B0(_t291, _t343, _t364);
																			__eflags = _t230;
																			if(_t230 == 0) {
																				goto L109;
																			} else {
																				_t392[3] = _t230;
																				_t392[7] = _t230;
																				_t392[1] = 0x10;
																				_t392[2] = "Failed to map frame into derived frame context: %d.\n";
																				 *_t392 = _t364;
																				E10023A40();
																				 *_t392 =  &(_t392[0xb]);
																				L1001ADB0("Failed to map frame into derived frame context: %d.\n");
																				_t220 = _t392[7];
																				L103:
																				return _t220;
																			}
																		}
																	}
																}
															}
														} else {
															goto L75;
														}
													}
												}
											}
										}
									}
								}
							} else {
								__eflags = __ecx[4] - __eax;
								if(__ecx[4] == __eax) {
									L89:
									__eax = __edi[0xb8];
									__eflags = __eax;
									if(__eax == 0) {
										 *__esp = __edx;
										__ecx = "Invalid mapping found when attempting unmap.\n";
										__ebx = 0x10;
										__esp[2] = "Invalid mapping found when attempting unmap.\n";
										__esp[1] = 0x10;
										E10023A40() = 0xffffffea;
										L76:
										return _t214;
									} else {
										__esi =  *(__eax + 4);
										__eax = E1001B300(__ebx);
										__edi = __esp[0x11];
										__ebp = __esp[0x12];
										__eax =  *__esi;
										__esp[0x14] = __ebx;
										__esi = __esp[0x10];
										__ebx = __esp[0xf];
										__esp[0x15] = __eax;
										__esp =  &(__esp[0x13]);
										_push(_t383);
										_push(_t343);
										_push(_t362);
										_t396 = _t390 - 0x1c;
										_t297 = _t396[0xd];
										_t385 = _t396[0xc];
										_t345 = _t297 + 0x158;
										 *((intOrPtr*)(_t385 + 0x50)) =  *((intOrPtr*)(_t297 + 0x50));
										 *((intOrPtr*)(_t385 + 0x44)) =  *((intOrPtr*)(_t297 + 0x44));
										 *((intOrPtr*)(_t385 + 0x48)) =  *((intOrPtr*)(_t297 + 0x48));
										 *((intOrPtr*)(_t385 + 0x4c)) =  *((intOrPtr*)(_t297 + 0x4c));
										 *(_t385 + 0x120) =  *(_t297 + 0x120);
										 *(_t385 + 0xb4) =  *(_t297 + 0xb4);
										 *(_t385 + 0xb0) =  *(_t297 + 0xb0);
										 *_t396 = _t345;
										if(E1000EC10(_t289) == 0) {
											_t283 =  *(_t297 + 0xb4);
											_t341 =  *(_t297 + 0xb0);
											if((_t283 | _t341) != 0) {
												_t396[2] = _t283;
												_t396[1] = _t341;
												 *_t396 = _t385 + 0x158;
												E1000D1B0();
											} else {
												 *(_t385 + 0x15c) =  *(_t297 + 0x120);
												 *(_t385 + 0x158) = 0;
											}
										}
										_t308 = 0;
										_t247 = E1001A6C0(_t385, 0, _t297, 0);
										_t368 = _t247;
										if(_t247 < 0) {
											L20:
											E1001A460(_t385);
											return _t368;
										} else {
											 *_t396 = _t345;
											if(E1000EC10() != 0) {
												_t396[1] = _t345;
												 *_t396 = _t385 + 0x158;
												_t253 = E1000D340();
												__eflags = _t253;
												_t368 = _t253;
												if(_t253 < 0) {
													goto L20;
												} else {
													_t254 =  *(_t297 + 0xb8);
													__eflags = _t254;
													if(_t254 != 0) {
														goto L7;
													} else {
														goto L33;
													}
												}
											} else {
												_t254 =  *(_t297 + 0xb8);
												if(_t254 == 0) {
													L33:
													 *_t396 = _t385;
													_t396[1] = 0;
													_t281 = L1001ADF0();
													__eflags = _t281;
													_t368 = _t281;
													if(_t281 < 0) {
														goto L20;
													} else {
														_t396[1] = _t297;
														 *_t396 = _t385;
														_t282 = E1001B8D0();
														__eflags = _t282;
														_t368 = _t282;
														if(_t282 < 0) {
															goto L20;
														} else {
															goto L35;
														}
													}
												} else {
													L7:
													_t370 = 0;
													L9:
													while(1) {
														if(_t254 == 0) {
															L11:
															_t370 = _t370 + 1;
															if(_t370 != 8) {
																_t254 =  *(_t297 + 0xb8 + _t370 * 4);
																continue;
															} else {
																if( *((intOrPtr*)(_t297 + 0xd8)) == 0) {
																	L22:
																	_t255 =  *(_t297 + 0x128);
																	__eflags = _t255;
																	if(_t255 == 0) {
																		L24:
																		__eflags =  *(_t297 + 0x40) - _t297;
																		if( *(_t297 + 0x40) == _t297) {
																			 *(_t385 + 0x40) = _t385;
																			goto L38;
																		} else {
																			_t352 =  *(_t385 + 0x15c);
																			_t368 = 0xffffffea;
																			__eflags = _t352;
																			if(_t352 == 0) {
																				goto L20;
																			} else {
																				_t396[1] = _t352;
																				 *_t396 = 4;
																				_t267 = E100263A0();
																				 *(_t385 + 0x40) = _t267;
																				__eflags = _t267;
																				if(_t267 == 0) {
																					goto L19;
																				} else {
																					_t314 = _t352 * 4;
																					_t378 =  *(_t297 + 0x40);
																					_t353 = _t267;
																					__eflags = _t314 - 8;
																					if(_t314 >= 8) {
																						__eflags = _t267 & 0x00000001;
																						if((_t267 & 0x00000001) != 0) {
																							_t268 =  *_t378 & 0x000000ff;
																							_t353 = _t353 + 1;
																							_t378 = _t378 + 1;
																							_t314 = _t314 - 1;
																							 *(_t353 - 1) = _t268;
																						}
																						__eflags = _t353 & 0x00000002;
																						if((_t353 & 0x00000002) != 0) {
																							_t269 =  *_t378 & 0x0000ffff;
																							_t353 = _t353 + 2;
																							_t378 = _t378 + 2;
																							_t314 = _t314 - 2;
																							 *(_t353 - 2) = _t269;
																						}
																						__eflags = _t353 & 0x00000004;
																						if((_t353 & 0x00000004) == 0) {
																							goto L28;
																						} else {
																							_t356 = _t353 + 4;
																							 *(_t356 - 4) =  *_t378;
																							memcpy(_t356, _t378 + 4, _t314 - 4);
																							_t396 =  &(_t396[3]);
																							goto L38;
																						}
																						L50:
																						_t338 = _t337 + _t262;
																						_t375 = _t374 + _t262;
																						_t263 = 0;
																						__eflags = _t349 & 0x00000002;
																						if((_t349 & 0x00000002) != 0) {
																							 *_t338 =  *_t375 & 0x0000ffff;
																							_t263 = 2;
																						}
																						__eflags = _t349 & 0x00000001;
																						if((_t349 & 0x00000001) == 0) {
																							L35:
																							_t376 = 0;
																							__eflags = 0;
																						} else {
																							_t376 = 0;
																							 *((char*)(_t338 + _t263)) =  *(_t375 + _t263) & 0x000000ff;
																						}
																						return _t376;
																						goto L113;
																					} else {
																						L28:
																						memcpy(_t353, _t378, _t314);
																						_t396 =  &(_t396[3]);
																					}
																					L38:
																					__eflags = _t385 & 0x00000001;
																					_t335 = _t385;
																					_t309 = _t297;
																					_t347 = 0x20;
																					if((_t385 & 0x00000001) != 0) {
																						_t335 = _t385 + 1;
																						_t347 = 0x1f;
																						_t309 = _t297 + 1;
																						 *_t385 =  *_t297 & 0x000000ff;
																					}
																					__eflags = _t335 & 0x00000002;
																					if((_t335 & 0x00000002) != 0) {
																						_t257 =  *_t309 & 0x0000ffff;
																						_t335 = _t335 + 2;
																						_t309 =  &(_t309[1]);
																						_t347 = _t347 - 2;
																						 *(_t335 - 2) = _t257;
																					}
																					_t396[0xd] = _t297;
																					_t258 = 0;
																					_t373 = _t347 & 0xfffffffc;
																					__eflags = _t373;
																					do {
																						 *(_t335 + _t258) =  *(_t309 + _t258);
																						_t258 = _t258 + 4;
																						__eflags = _t258 - _t373;
																					} while (_t258 < _t373);
																					_t336 = _t335 + _t258;
																					_t310 = _t309 + _t258;
																					_t300 = _t396[0xd];
																					_t259 = 0;
																					__eflags = _t347 & 0x00000002;
																					if((_t347 & 0x00000002) != 0) {
																						 *_t336 =  *_t310 & 0x0000ffff;
																						_t259 = 2;
																					}
																					__eflags = _t347 & 0x00000001;
																					if((_t347 & 0x00000001) != 0) {
																						 *((char*)(_t336 + _t259)) =  *(_t310 + _t259) & 0x000000ff;
																					}
																					__eflags = _t385 & 0x00000001;
																					_t349 = 0x20;
																					_t337 = _t385 + 0x20;
																					_t374 = _t300 + 0x20;
																					if((_t385 & 0x00000001) != 0) {
																						_t337 = _t385 + 0x21;
																						_t349 = 0x1f;
																						_t374 = _t300 + 0x21;
																						 *(_t385 + 0x20) =  *(_t300 + 0x20) & 0x000000ff;
																					}
																					__eflags = _t337 & 0x00000002;
																					if((_t337 & 0x00000002) != 0) {
																						_t261 =  *_t374 & 0x0000ffff;
																						_t337 = _t337 + 2;
																						_t374 =  &(_t374[1]);
																						_t349 = _t349 - 2;
																						 *(_t337 - 2) = _t261;
																					}
																					_t262 = 0;
																					_t302 = _t349 & 0xfffffffc;
																					__eflags = _t302;
																					do {
																						 *(_t337 + _t262) =  *(_t374 + _t262);
																						_t262 = _t262 + 4;
																						__eflags = _t262 - _t302;
																					} while (_t262 < _t302);
																					goto L50;
																				}
																			}
																		}
																	} else {
																		 *_t396 = _t255;
																		_t273 = L10009FC0(_t297, _t308);
																		 *(_t385 + 0x128) = _t273;
																		__eflags = _t273;
																		if(_t273 == 0) {
																			goto L19;
																		} else {
																			goto L24;
																		}
																	}
																} else {
																	_t308 = 4;
																	_t396[1] = 4;
																	 *_t396 =  *(_t297 + 0xdc);
																	_t275 = E100266D0();
																	 *((intOrPtr*)(_t385 + 0xd8)) = _t275;
																	if(_t275 == 0) {
																		goto L19;
																	} else {
																		_t339 =  *(_t297 + 0xdc);
																		 *(_t385 + 0xdc) = _t339;
																		if(_t339 <= 0) {
																			goto L22;
																		} else {
																			_t396[0xc] = _t385;
																			_t388 = _t297;
																			_t304 = 0;
																			while(1) {
																				_t381 = _t304 * 4;
																				 *_t396 =  *( *((intOrPtr*)(_t388 + 0xd8)) + _t381);
																				 *((intOrPtr*)(_t275 + _t381)) = L10009FC0(_t304, _t308);
																				_t275 =  *((intOrPtr*)(_t396[0xc] + 0xd8));
																				if( *((intOrPtr*)(_t275 + _t381)) == 0) {
																					break;
																				}
																				_t304 = _t304 + 1;
																				__eflags =  *((intOrPtr*)(_t388 + 0xdc)) - _t304;
																				if( *((intOrPtr*)(_t388 + 0xdc)) <= _t304) {
																					_t297 = _t388;
																					_t385 = _t396[0xc];
																					goto L22;
																				} else {
																					continue;
																				}
																				goto L113;
																			}
																			_t385 = _t396[0xc];
																			goto L19;
																		}
																	}
																}
															}
														} else {
															 *_t396 = _t254;
															_t280 = L10009FC0(_t297, _t308);
															 *((intOrPtr*)(_t385 + 0xb8 + _t370 * 4)) = _t280;
															if(_t280 == 0) {
																L19:
																_t368 = 0xfffffff4;
																goto L20;
															} else {
																goto L11;
															}
														}
														goto L113;
													}
												}
											}
										}
									}
								} else {
									goto L68;
								}
							}
						}
					}
				}
				L113:
			}

0x1001e0b0
0x1001e0b3
0x1001e0bb
0x1001e0bf
0x1001e0c3
0x1001e0c7
0x1001e0cb
0x1001e0cf
0x1001e0d9
0x1001e0dc
0x1001e0e4
0x1001e0e8
0x1001e200
0x00000000
0x1001e0ee
0x1001e0ee
0x1001e0f0
0x1001e0f3
0x1001e1b0
0x1001e1b3
0x1001e1b6
0x00000000
0x1001e1bc
0x1001e1bf
0x1001e1c1
0x1001e1c4
0x1001e1c6
0x00000000
0x00000000
0x00000000
0x00000000
0x1001e1c6
0x1001e0f9
0x1001e0f9
0x1001e0fc
0x1001e0fe
0x1001e218
0x1001e21b
0x1001e21e
0x00000000
0x1001e224
0x1001e224
0x1001e227
0x00000000
0x00000000
0x00000000
0x00000000
0x1001e227
0x1001e104
0x1001e104
0x1001e104
0x1001e107
0x1001e10b
0x1001e10e
0x1001e110
0x1001e11b
0x1001e11b
0x1001e11e
0x1001e121
0x1001e27e
0x1001e280
0x1001e283
0x1001e285
0x1001e1cc
0x1001e1cc
0x1001e1d0
0x1001e1d4
0x1001e1d8
0x1001e1db
0x1001e1df
0x1001e1e1
0x1001e1e3
0x00000000
0x1001e1e5
0x1001e1e5
0x1001e1e8
0x00000000
0x1001e1ee
0x1001e1ee
0x1001e202
0x1001e202
0x1001e204
0x00000000
0x1001e206
0x1001e209
0x00000000
0x1001e209
0x1001e204
0x1001e1e8
0x1001e28b
0x1001e28b
0x1001e20d
0x1001e20d
0x00000000
0x1001e20d
0x1001e127
0x1001e127
0x1001e12b
0x1001e12e
0x1001e270
0x1001e270
0x00000000
0x1001e134
0x1001e139
0x1001e13c
0x1001e13e
0x00000000
0x1001e144
0x1001e144
0x1001e14c
0x1001e150
0x1001e153
0x1001e157
0x1001e159
0x1001e15b
0x00000000
0x1001e15d
0x1001e15d
0x1001e160
0x00000000
0x1001e166
0x1001e166
0x1001e166
0x1001e168
0x1001e176
0x1001e176
0x1001e17a
0x1001e17c
0x1001e182
0x1001e185
0x1001e18a
0x1001e18e
0x1001e194
0x00000000
0x1001e16a
0x1001e16a
0x1001e170
0x1001e2b6
0x1001e2be
0x1001e2c0
0x1001e2c4
0x1001e2c7
0x1001e2cf
0x1001e2d7
0x1001e2df
0x1001e2e4
0x1001e2f0
0x1001e2f1
0x1001e2f2
0x1001e2f5
0x1001e2f9
0x1001e2fd
0x1001e300
0x1001e303
0x1001e306
0x1001e308
0x1001e3c0
0x1001e3c2
0x1001e3c5
0x1001e3c7
0x1001e445
0x00000000
0x1001e3c9
0x1001e3cc
0x1001e3ce
0x1001e43b
0x00000000
0x1001e3d0
0x1001e3d0
0x1001e3d3
0x1001e3d8
0x1001e3de
0x1001e3e0
0x00000000
0x1001e3e2
0x1001e3e7
0x1001e3eb
0x1001e3ee
0x1001e3f1
0x1001e3f3
0x1001e420
0x1001e42a
0x1001e42d
0x1001e432
0x00000000
0x1001e3f5
0x1001e3f5
0x1001e3fb
0x1001e3ff
0x1001e3ff
0x1001e3f3
0x1001e3e0
0x1001e3ce
0x1001e30e
0x1001e311
0x1001e314
0x1001e317
0x1001e31c
0x1001e322
0x1001e324
0x1001e3b0
0x1001e3b0
0x00000000
0x1001e32a
0x1001e32a
0x1001e32f
0x1001e333
0x1001e335
0x00000000
0x1001e337
0x1001e337
0x1001e33d
0x1001e344
0x1001e347
0x1001e34a
0x1001e34f
0x1001e351
0x1001e400
0x1001e400
0x1001e408
0x1001e40b
0x1001e419
0x1001e357
0x1001e35d
0x1001e360
0x1001e368
0x1001e36c
0x1001e371
0x1001e373
0x00000000
0x1001e379
0x1001e379
0x1001e382
0x1001e38b
0x1001e38f
0x1001e393
0x1001e396
0x1001e39f
0x1001e3a2
0x1001e3a7
0x1001e3b5
0x1001e3ba
0x1001e3ba
0x1001e373
0x1001e351
0x1001e335
0x1001e324
0x00000000
0x00000000
0x00000000
0x1001e170
0x1001e168
0x1001e160
0x1001e15b
0x1001e13e
0x1001e12e
0x1001e112
0x1001e112
0x1001e115
0x1001e230
0x1001e230
0x1001e236
0x1001e238
0x1001e292
0x1001e295
0x1001e29a
0x1001e29f
0x1001e2a3
0x1001e2ac
0x1001e197
0x1001e1aa
0x1001e23a
0x1001e23a
0x1001e240
0x1001e245
0x1001e249
0x1001e24d
0x1001e24f
0x1001e253
0x1001e257
0x1001e25b
0x1001e25f
0x1001bc40
0x1001bc41
0x1001bc42
0x1001bc44
0x1001bc47
0x1001bc4b
0x1001bc52
0x1001bc5e
0x1001bc64
0x1001bc6a
0x1001bc70
0x1001bc79
0x1001bc85
0x1001bc8b
0x1001bc91
0x1001bc9b
0x1001bc9d
0x1001bca3
0x1001bcad
0x1001be70
0x1001be7a
0x1001be7e
0x1001be81
0x1001bcb3
0x1001bcb9
0x1001bcc1
0x1001bcc1
0x1001bcad
0x1001bcc7
0x1001bccd
0x1001bcd4
0x1001bcd6
0x1001bdb8
0x1001bdba
0x1001bdc8
0x1001bcdc
0x1001bcdc
0x1001bce6
0x1001be40
0x1001be4a
0x1001be4d
0x1001be52
0x1001be54
0x1001be56
0x00000000
0x1001be5c
0x1001be5c
0x1001be62
0x1001be64
0x00000000
0x1001be6a
0x00000000
0x1001be6a
0x1001be64
0x1001bcec
0x1001bcec
0x1001bcf4
0x1001be90
0x1001be90
0x1001be95
0x1001be99
0x1001be9e
0x1001bea0
0x1001bea2
0x00000000
0x1001bea8
0x1001bea8
0x1001beac
0x1001beaf
0x1001beb4
0x1001beb6
0x1001beb8
0x00000000
0x00000000
0x00000000
0x00000000
0x1001beb8
0x1001bcfa
0x1001bcfa
0x1001bcfa
0x00000000
0x1001bd07
0x1001bd09
0x1001bd22
0x1001bd22
0x1001bd26
0x1001bd00
0x00000000
0x1001bd28
0x1001bd30
0x1001bdd6
0x1001bdd6
0x1001bddc
0x1001bdde
0x1001bdf2
0x1001bdf2
0x1001bdf5
0x1001bed0
0x00000000
0x1001bdfb
0x1001bdfb
0x1001be01
0x1001be06
0x1001be08
0x00000000
0x1001be0a
0x1001be0a
0x1001be0e
0x1001be15
0x1001be1a
0x1001be1d
0x1001be1f
0x00000000
0x1001be21
0x1001be21
0x1001be28
0x1001be2b
0x1001be2d
0x1001be30
0x1001bf96
0x1001bf98
0x1001c033
0x1001c036
0x1001c037
0x1001c038
0x1001c039
0x1001c039
0x1001bf9e
0x1001bfa4
0x1001c01e
0x1001c021
0x1001c024
0x1001c027
0x1001c02a
0x1001c02a
0x1001bfa6
0x1001bfac
0x00000000
0x1001bfb2
0x1001bfb4
0x1001bfbd
0x1001bfc0
0x1001bfc0
0x00000000
0x1001bfc0
0x1001bf66
0x1001bf66
0x1001bf68
0x1001bf6a
0x1001bf6c
0x1001bf72
0x1001bf77
0x1001bf7a
0x1001bf7a
0x1001bf7f
0x1001bf82
0x1001bebe
0x1001bebe
0x1001bebe
0x1001bf88
0x1001bf8c
0x1001bf8e
0x1001bf8e
0x1001bec9
0x00000000
0x1001be36
0x1001be36
0x1001be36
0x1001be36
0x1001be36
0x1001bed3
0x1001bed3
0x1001bed9
0x1001bedb
0x1001bedd
0x1001bee2
0x1001bfdf
0x1001bfe2
0x1001bfe7
0x1001bfea
0x1001bfea
0x1001bee8
0x1001beeb
0x1001bfc7
0x1001bfca
0x1001bfcd
0x1001bfd0
0x1001bfd3
0x1001bfd3
0x1001bef1
0x1001bef7
0x1001bef9
0x1001bef9
0x1001befc
0x1001beff
0x1001bf02
0x1001bf05
0x1001bf05
0x1001bf09
0x1001bf0b
0x1001bf0d
0x1001bf11
0x1001bf13
0x1001bf19
0x1001bf1e
0x1001bf21
0x1001bf21
0x1001bf26
0x1001bf29
0x1001bf2f
0x1001bf2f
0x1001bf32
0x1001bf38
0x1001bf3d
0x1001bf40
0x1001bf43
0x1001c00b
0x1001c00e
0x1001c013
0x1001c016
0x1001c016
0x1001bf49
0x1001bf4c
0x1001bff2
0x1001bff5
0x1001bff8
0x1001bffb
0x1001bffe
0x1001bffe
0x1001bf54
0x1001bf56
0x1001bf56
0x1001bf59
0x1001bf5c
0x1001bf5f
0x1001bf62
0x1001bf62
0x00000000
0x1001bf59
0x1001be1f
0x1001be08
0x1001bde0
0x1001bde0
0x1001bde3
0x1001bde8
0x1001bdee
0x1001bdf0
0x00000000
0x00000000
0x00000000
0x00000000
0x1001bdf0
0x1001bd36
0x1001bd36
0x1001bd3b
0x1001bd45
0x1001bd48
0x1001bd4d
0x1001bd55
0x00000000
0x1001bd57
0x1001bd57
0x1001bd5d
0x1001bd65
0x00000000
0x1001bd67
0x1001bd67
0x1001bd6d
0x1001bd6f
0x1001bd81
0x1001bd81
0x1001bd94
0x1001bd9c
0x1001bda2
0x1001bdad
0x00000000
0x00000000
0x1001bd78
0x1001bd79
0x1001bd7f
0x1001bdd0
0x1001bdd2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1001bd7f
0x1001bdaf
0x00000000
0x1001bdaf
0x1001bd65
0x1001bd55
0x1001bd30
0x1001bd0b
0x1001bd0b
0x1001bd0e
0x1001bd13
0x1001bd1c
0x1001bdb3
0x1001bdb3
0x00000000
0x00000000
0x00000000
0x00000000
0x1001bd1c
0x00000000
0x1001bd09
0x1001bd07
0x1001bcf4
0x1001bce6
0x1001bcd6
0x00000000
0x00000000
0x00000000
0x1001e115
0x1001e110
0x1001e0fe
0x1001e0f3
0x00000000

APIs

mv_frame_unref.MAIN ref: 1001E185
mv_frame_unref.MAIN ref: 1001E240

Strings

Invalid mapping found when attempting unmap., xrefs: 1001E295
Failed to map frame into derived frame context: %d., xrefs: 1001E37D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_frame_unref
String ID: Failed to map frame into derived frame context: %d.$Invalid mapping found when attempting unmap.
API String ID: 3522828444-968520014
Opcode ID: c51a9e1b472074b834904429bd500262b32e19eb408ec7d04c88999b5f63e95e
Instruction ID: a9b2bb0cb6fdc28be8a2433754fc5c1c364900424f67e1161cdcac98c29180a2
Opcode Fuzzy Hash: c51a9e1b472074b834904429bd500262b32e19eb408ec7d04c88999b5f63e95e
Instruction Fuzzy Hash: 9A91BEB8A097419FC744CF29C58090EBBE0FF88754F16896EE9998B351D730ED81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004A328 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1004A35C
mv_calloc.MAIN ref: 1004A389
AcquireSRWLockExclusive.KERNEL32 ref: 1004A474
_beginthreadex.MSVCRT ref: 1004A4B6
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A4ED
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A52F
mvpriv_slicethread_free.MAIN ref: 1004A53E
mv_cpu_count.MAIN ref: 1004A550
mv_mallocz.MAIN ref: 1004A58A
mv_log.MAIN ref: 1004A5D1
abort.MSVCRT ref: 1004A5D6
mv_freep.MAIN ref: 1004A5E2

Strings

j, xrefs: 1004A5A8

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$Releasemv_mallocz$Acquire_beginthreadexabortmv_callocmv_cpu_countmv_freepmv_logmvpriv_slicethread_free
String ID: j
API String ID: 2987404029-2137352139
Opcode ID: a1457cafe947b66c241fed8b9d7c715ac0131585819b2ddc446b0be713ed2993
Instruction ID: 08bf606ddb186d207094264f2d447dbf8bdb9a5961cd0d480e83cb1c64d41ca3
Opcode Fuzzy Hash: a1457cafe947b66c241fed8b9d7c715ac0131585819b2ddc446b0be713ed2993
Instruction Fuzzy Hash: 5F81E3B5A087409FD740EF29D48061ABBE0FF89344F11892EF8999B341D775E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1009E7E0 Relevance: 24.5, APIs: 4, Strings: 10, Instructions: 48
threadCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E1009E7E0() {
				char _v16;
				void _v76;
				char _v79;
				char _v80;
				intOrPtr _v83;
				intOrPtr _v87;
				intOrPtr _v91;
				intOrPtr _v95;
				intOrPtr _v99;
				intOrPtr _v103;
				intOrPtr _v107;
				intOrPtr _v111;
				intOrPtr _v115;
				char _v119;
				long _v132;
				char* _v136;
				long _t28;
				void* _t30;
				void* _t33;
				void* _t34;
				long _t36;
				void* _t39;
				long* _t41;

				_v119 = 0x6f727245;
				_v115 = 0x6c632072;
				_v111 = 0x696e6165;
				_v107 = 0x7520676e;
				_v103 = 0x70732070;
				_v99 = 0x6b5f6e69;
				_v95 = 0x20737965;
				_v91 = 0x20726f66;
				_v87 = 0x65726874;
				_v83 = 0x206461;
				_v79 = 0;
				_v16 = 0;
				memset( &_v76, 0, 0x10 << 2);
				_t41 = _t39 - 0x88 + 0xc;
				_t28 = GetCurrentThreadId();
				_v132 = 0xa;
				_v136 =  &_v80;
				 *_t41 = _t28;
				__imp___ultoa();
				if(_v80 == 0) {
					L8:
					_t33 = 0x28;
					_t25 =  &_v119; // 0x6f727245
					_t36 = _t25;
					L6:
					_t41[0xf] = 0xa;
					 *((char*)(_t41 + _t33 + 0x15)) = 0;
					L7:
					 *_t41 = _t36;
					OutputDebugStringA(??);
					_t41 = _t41 - 4;
					abort();
					goto L8;
				}
				_t30 = 0x27;
				_t19 =  &_v119; // 0x6f727245
				_t36 = _t19;
				while(1) {
					_t34 = _t30;
					_t30 = _t30 + 1;
					if( *((char*)(_t36 + _t30)) == 0) {
						break;
					}
					if(_t30 == 0x6a) {
						goto L7;
					}
				}
				if(_t30 == 0x6a) {
					goto L7;
				}
				_t33 = _t34 + 2;
				goto L6;
			}

0x1009e7f2
0x1009e7fa
0x1009e802
0x1009e80a
0x1009e812
0x1009e81a
0x1009e822
0x1009e82a
0x1009e832
0x1009e83a
0x1009e842
0x1009e84a
0x1009e852
0x1009e852
0x1009e854
0x1009e85e
0x1009e866
0x1009e86a
0x1009e86d
0x1009e878
0x1009e8bb
0x1009e8bb
0x1009e8c5
0x1009e8c5
0x1009e8a0
0x1009e8a0
0x1009e8a5
0x1009e8aa
0x1009e8aa
0x1009e8ad
0x1009e8b3
0x1009e8b6
0x00000000
0x1009e8b6
0x1009e87a
0x1009e87f
0x1009e87f
0x1009e88d
0x1009e88d
0x1009e88f
0x1009e896
0x00000000
0x00000000
0x1009e88b
0x00000000
0x00000000
0x1009e88b
0x1009e89b
0x00000000
0x00000000
0x1009e89d
0x00000000

APIs

GetCurrentThreadId.KERNEL32 ref: 1009E854
_ultoa.MSVCRT ref: 1009E86D
OutputDebugStringA.KERNEL32 ref: 1009E8AD
abort.MSVCRT ref: 1009E8B6

Strings

in_k, xrefs: 1009E81A
r cl, xrefs: 1009E7FA
for , xrefs: 1009E82A
Erro, xrefs: 1009E87F
eani, xrefs: 1009E802
eys , xrefs: 1009E822
ad , xrefs: 1009E83A
thre, xrefs: 1009E832
p sp, xrefs: 1009E812
ng u, xrefs: 1009E80A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Erro$ad $eani$eys $for $in_k$ng u$p sp$r cl$thre
API String ID: 4191895893-3726152543
Opcode ID: 32d6918716459faddcb7dc1042b6d8857ba7126cf37684ded785e2cb3a3e0069
Instruction ID: 088c25127c847526b46776e24d12a3bdf4591a2816cfb9b61a0b1617db757378
Opcode Fuzzy Hash: 32d6918716459faddcb7dc1042b6d8857ba7126cf37684ded785e2cb3a3e0069
Instruction Fuzzy Hash: 942117B050C3819FE354EF64C19931FBBE2EB81304F909D2DE4894A3A5CBB9C9498B47

Uniqueness

Uniqueness Score: -1.00%

Function 10010320 Relevance: 22.7, APIs: 15, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E10010320(intOrPtr* _a4) {
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t97;
				signed int _t100;
				signed int _t106;
				signed int _t112;
				signed int _t118;
				signed int _t124;
				signed int _t130;
				signed int _t136;
				signed int _t139;
				signed int _t147;
				intOrPtr _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr _t153;
				signed int _t154;
				signed int _t158;
				signed int _t172;
				signed int _t174;
				signed int _t176;
				signed int _t178;
				signed int _t180;
				signed int _t182;
				signed int _t184;
				signed int _t186;
				signed int _t187;
				intOrPtr* _t188;
				intOrPtr* _t189;
				signed int _t199;
				void* _t200;
				intOrPtr* _t201;

				_t188 = 0x100b0200;
				_t201 = _t200 - 0x2c;
				_v40 = 0;
				_t189 = _a4;
				while(1) {
					_v40 = _v40 + 1;
					_t188 = _t188 + 0x40;
					if(_v40 == 0x17) {
						break;
					}
					_t6 = _t188 + 0x10; // 0x1000ffb0
					if( *_t6 == 0) {
						continue;
					} else {
						_t9 = _t188 + 0x10; // 0x1000ffb0
						_t10 = _t188 + 0x14; // 0x10010008
						_t172 =  *_t10;
						 *_t201 =  *((intOrPtr*)(_t189 + 0x10));
						_v56 =  *((intOrPtr*)(_t189 + 0x14));
						_v52 =  *_t9;
						_v48 = _t172;
						_t97 = L10032EF0( *((intOrPtr*)(_t189 + 0x14)), _t188, _t189);
						_t147 = _t172;
						_t14 = _t188 + 0x1c; // 0x1000fde8
						_t192 =  <  ? _t97 :  ~_t97;
						_t15 = _t188 + 0x18; // 0x10010060
						_v48 =  *_t14;
						_v52 =  *_t15;
						_t174 =  *((intOrPtr*)(_t189 + 0x1c));
						 *_t201 =  *((intOrPtr*)(_t189 + 0x18));
						_v56 = _t174;
						_t100 = L10032EF0(_t147, _t188, _t189);
						 *_t201 =  <  ? _t97 :  ~_t97;
						_v56 = _t147;
						_v48 = _t174;
						_t102 =  <  ? _t100 :  ~_t100;
						_v52 =  <  ? _t100 :  ~_t100;
						_t148 = L10032E70(_t147, _t189);
						_t24 = _t188 + 0x20; // 0x1000fe50
						_t25 = _t188 + 0x24; // 0x0
						_v52 =  *_t24;
						_v48 =  *_t25;
						_t176 =  *((intOrPtr*)(_t189 + 0x24));
						 *_t201 =  *((intOrPtr*)(_t189 + 0x20));
						_v56 = _t176;
						_t106 = L10032EF0(_t148, _t188, _t189);
						 *_t201 = _t148;
						_v56 = _t174;
						_v48 = _t176;
						_t108 =  <  ? _t106 :  ~_t106;
						_v52 =  <  ? _t106 :  ~_t106;
						_t149 = L10032E70(_t148, _t189);
						_t34 = _t188 + 0x28; // 0x0
						_t35 = _t188 + 0x2c; // 0x0
						_v52 =  *_t34;
						_v48 =  *_t35;
						_t178 =  *((intOrPtr*)(_t189 + 0x2c));
						 *_t201 =  *((intOrPtr*)(_t189 + 0x28));
						_v56 = _t178;
						_t112 = L10032EF0(_t149, _t188, _t189);
						 *_t201 = _t149;
						_v56 = _t176;
						_v48 = _t178;
						_t114 =  <  ? _t112 :  ~_t112;
						_v52 =  <  ? _t112 :  ~_t112;
						_t150 = L10032E70(_t149, _t189);
						_t44 = _t188 + 0x30; // 0x0
						_t45 = _t188 + 0x34; // 0x0
						_v52 =  *_t44;
						_v48 =  *_t45;
						_t180 =  *((intOrPtr*)(_t189 + 0x34));
						 *_t201 =  *((intOrPtr*)(_t189 + 0x30));
						_v56 = _t180;
						_t118 = L10032EF0(_t150, _t188, _t189);
						 *_t201 = _t150;
						_v56 = _t178;
						_v48 = _t180;
						_t120 =  <  ? _t118 :  ~_t118;
						_v52 =  <  ? _t118 :  ~_t118;
						_t151 = L10032E70(_t150, _t189);
						_t54 = _t188 + 0x38; // 0x0
						_t55 = _t188 + 0x3c; // 0x0
						_v52 =  *_t54;
						_v48 =  *_t55;
						_t182 =  *((intOrPtr*)(_t189 + 0x3c));
						 *_t201 =  *((intOrPtr*)(_t189 + 0x38));
						_v56 = _t182;
						_t124 = L10032EF0(_t151, _t188, _t189);
						 *_t201 = _t151;
						_v56 = _t180;
						_v48 = _t182;
						_t126 =  <  ? _t124 :  ~_t124;
						_v52 =  <  ? _t124 :  ~_t124;
						_t152 = L10032E70(_t151, _t189);
						_t64 = _t188 + 4; // 0x1000fea8
						_v52 =  *_t188;
						_v48 =  *_t64;
						_t184 =  *(_t189 + 4);
						 *_t201 =  *_t189;
						_v56 = _t184;
						_t130 = L10032EF0(_t152, _t188, _t189);
						 *_t201 = _t152;
						_v56 = _t182;
						_v48 = _t184;
						_t132 =  <  ? _t130 :  ~_t130;
						_v52 =  <  ? _t130 :  ~_t130;
						_t153 = L10032E70(_t152, _t189);
						_t72 = _t188 + 8; // 0x1000ff00
						_t73 = _t188 + 0xc; // 0x1000ff58
						_v52 =  *_t72;
						_v48 =  *_t73;
						_t186 =  *(_t189 + 0xc);
						 *_t201 =  *((intOrPtr*)(_t189 + 8));
						_v56 = _t186;
						_t136 = L10032EF0(_t153, _t188, _t189);
						 *_t201 = _t153;
						_v56 = _t184;
						_v48 = _t186;
						_t138 =  <  ? _t136 :  ~_t136;
						_v52 =  <  ? _t136 :  ~_t136;
						_t139 = L10032E70(_t153, _t189);
						_v36 = _t186;
						_t154 = _t139;
						_t199 = _t186;
						_v32 = _t186 >> 0x1f;
						_t187 = 0x3e8 * _t154 >> 0x20;
						asm("sbb edx, [esp+0x1c]");
						if((_t187 | 0x000003e8 * _t154 - _v36) != 0) {
							_t158 = (_v32 ^ _t187) >> 0x0000001f | 0x00000001;
							goto L7;
						} else {
							if(_t199 != 0) {
								continue;
							} else {
								if(_t154 == 0) {
									L8:
									return _v40;
								} else {
									_t158 = _t154 >> 0x1f;
									L7:
									if(_t158 + 1 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
						}
					}
					L11:
				}
				_v40 = 2;
				return _v40;
				goto L11;
			}

0x10010324
0x1001032b
0x1001032e
0x10010332
0x10010340
0x10010340
0x10010344
0x1001034e
0x00000000
0x00000000
0x10010354
0x10010359
0x00000000
0x1001035b
0x10010361
0x10010364
0x10010364
0x10010367
0x1001036a
0x1001036e
0x10010372
0x10010376
0x1001037d
0x1001037f
0x10010384
0x10010387
0x1001038a
0x1001038e
0x10010395
0x10010398
0x1001039b
0x1001039f
0x100103a4
0x100103a7
0x100103ab
0x100103b3
0x100103b6
0x100103bf
0x100103c3
0x100103c6
0x100103c9
0x100103cd
0x100103d4
0x100103d7
0x100103da
0x100103de
0x100103e3
0x100103e6
0x100103ea
0x100103f2
0x100103f5
0x100103fe
0x10010402
0x10010405
0x10010408
0x1001040c
0x10010413
0x10010416
0x10010419
0x1001041d
0x10010422
0x10010425
0x10010429
0x10010431
0x10010434
0x1001043d
0x10010441
0x10010444
0x10010447
0x1001044b
0x10010452
0x10010455
0x10010458
0x1001045c
0x10010461
0x10010464
0x10010468
0x10010470
0x10010473
0x1001047c
0x10010480
0x10010483
0x10010486
0x1001048a
0x10010491
0x10010494
0x10010497
0x1001049b
0x100104a0
0x100104a3
0x100104a7
0x100104af
0x100104b2
0x100104bb
0x100104c1
0x100104c4
0x100104c8
0x100104ce
0x100104d1
0x100104d4
0x100104d8
0x100104dd
0x100104e0
0x100104e4
0x100104ec
0x100104ef
0x100104f8
0x100104fc
0x100104ff
0x10010502
0x10010506
0x1001050d
0x10010510
0x10010513
0x10010517
0x1001051c
0x1001051f
0x10010523
0x1001052b
0x1001052e
0x10010532
0x10010537
0x1001053b
0x10010542
0x10010544
0x1001054d
0x10010553
0x1001055b
0x10010591
0x00000000
0x1001055d
0x1001055f
0x00000000
0x10010565
0x10010567
0x10010576
0x10010581
0x10010569
0x10010569
0x1001056c
0x10010570
0x00000000
0x00000000
0x00000000
0x00000000
0x10010570
0x10010567
0x1001055f
0x1001055b
0x00000000
0x10010359
0x100105a5
0x100105b4
0x00000000

APIs

mv_sub_q.MAIN ref: 10010376
mv_sub_q.MAIN ref: 1001039F
mv_add_q.MAIN ref: 100103BA
mv_sub_q.MAIN ref: 100103DE
mv_add_q.MAIN ref: 100103F9
mv_sub_q.MAIN ref: 1001041D
mv_add_q.MAIN ref: 10010438
mv_sub_q.MAIN ref: 1001045C
mv_add_q.MAIN ref: 10010477
mv_sub_q.MAIN ref: 1001049B
mv_add_q.MAIN ref: 100104B6

Part of subcall function 10032E70: mv_reduce.MAIN(?,?), ref: 10032EC9

mv_sub_q.MAIN ref: 100104D8

Part of subcall function 10032EF0: mv_reduce.MAIN(?), ref: 10032F61

mv_add_q.MAIN ref: 100104F3
mv_sub_q.MAIN ref: 10010517
mv_add_q.MAIN ref: 10010532

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_sub_q$mv_add_q$mv_reduce
String ID:
API String ID: 416313997-0
Opcode ID: 16bc828a6e54490581e3bca817dbe7aaeb3a5d58f0d8fddf083b3c311aad9c19
Instruction ID: 137885487f331a62fd44dc5ad255b81a0a07b8edcdf78e8c3b60c95945d2ee5e
Opcode Fuzzy Hash: 16bc828a6e54490581e3bca817dbe7aaeb3a5d58f0d8fddf083b3c311aad9c19
Instruction Fuzzy Hash: 9881B2B4A08B06AFC744DF6AC18151AFBE1FF88251F10C92EE98DC7711E670E8519F82

Uniqueness

Uniqueness Score: -1.00%

Function 1001F200 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E1001F200(signed int __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t98;
				signed int _t103;
				void* _t117;
				signed int _t121;
				signed int _t125;
				signed int _t129;
				signed int _t133;
				void* _t138;
				void* _t140;
				void* _t141;
				void* _t142;
				signed int _t143;
				signed int _t144;
				void* _t148;
				signed int _t159;
				signed int _t163;
				signed int* _t165;
				void* _t170;
				signed int _t172;
				signed int _t174;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				void* _t183;
				signed char _t184;
				signed int _t190;
				void* _t191;
				signed int _t192;
				signed int _t194;
				void* _t195;
				void* _t197;
				signed int* _t198;
				signed int _t210;

				_t174 = __edx;
				_t198 = _t197 - 0x5c;
				_t165 = _t198[0x1d];
				_t194 = _t198[0x1e];
				_t192 = _t198[0x21];
				 *_t198 = _t198[0x20];
				_t98 = E10031C70();
				_t198[0xb] = _t98;
				_t201 = _t98;
				if(_t98 == 0) {
					L29:
					_t195 = 0xffffffea;
					goto L17;
				} else {
					_t198[1] = _t194;
					_t198[0x11] = 0;
					_t198[0x12] = 0;
					_t198[2] = 0;
					 *_t198 = 0xffffffff;
					_t198[0x10] = 0x100b3560;
					_t103 = E1001E960(_t201);
					asm("cdq");
					asm("sbb edi, edx");
					if(0 >= _t103) {
						_t174 = (0 << 0x00000020 | _t194) << 3;
						_t103 = _t194 << 3;
					}
					_t198[8] = _t103 + 0x400;
					_t105 = _t198[0x1f];
					asm("adc edx, 0x0");
					_t198[9] = _t174;
					if((_t198[0x1f] & 0xffffff00 | _t105 <= 0x00000000 | _t174 & 0xffffff00 | _t194 <= 0x00000000) != 0) {
						L28:
						_t198[3] = _t194;
						_t198[4] = _t198[0x1f];
						_t198[2] = "Picture size %ux%u is invalid\n";
						_t198[1] = 0x10;
						 *_t198 =  &(_t198[0x10]);
						E10023A40();
						goto L29;
					}
					asm("sbb ecx, edx");
					if(0x7ffffffe < _t198[8]) {
						goto L28;
					}
					asm("sbb edi, edx");
					if(0x7ffffffe < (_t198[0x1f] + 0x80) * _t198[8]) {
						goto L28;
					}
					if(_t192 > 7) {
						_t163 = _t194 + 0x00000007 & 0xfffffff8;
						_t210 = _t163;
						_t194 = _t163;
					}
					_t198[2] = _t194;
					 *_t198 = _t165;
					_t198[1] = _t198[0x20];
					_t117 = E1001EAB0(_t210);
					_t211 = _t117;
					_t195 = _t117;
					if(_t117 < 0) {
						L17:
						return _t195;
					} else {
						_t180 =  ~_t192;
						_t121 =  *_t165 + _t192 - 0x00000001 & _t180;
						 *_t165 = _t121;
						_t198[0xc] = _t121;
						_t125 = _t165[1] + _t192 - 0x00000001 & _t180;
						_t165[1] = _t125;
						_t198[0xd] = _t125;
						_t129 = _t165[2] + _t192 - 0x00000001 & _t180;
						_t165[2] = _t129;
						_t198[0xe] = _t129;
						_t133 = _t165[3] + _t192 - 0x00000001 & _t180;
						_t165[3] = _t133;
						_t198[0xf] = _t133;
						_t198[3] =  &(_t198[0xc]);
						_t198[2] = _t198[0x1f];
						_t198[1] = _t198[0x20];
						 *_t198 =  &(_t198[0x10]);
						_t138 = L1001EE90(_t165, 0, _t192, _t195, _t211);
						_t195 = _t138;
						if(_t138 < 0) {
							goto L17;
						}
						_t140 = _t192 + _t198[0x10];
						if(_t140 < 0) {
							goto L29;
						}
						_t141 = _t140 + _t198[0x11];
						if(_t141 < 0) {
							goto L29;
						}
						_t142 = _t141 + _t198[0x12];
						if(_t142 < 0) {
							goto L29;
						}
						_t143 = _t142 + _t198[0x13];
						if(_t143 < 0) {
							goto L29;
						}
						 *_t198 = _t143;
						_t144 = E10026230();
						_t190 = _t144;
						if(_t144 == 0) {
							_t195 = 0xfffffff4;
							goto L17;
						}
						_t198[3] = _t144;
						_t198[4] = _t165;
						_t198[2] = _t198[0x1f];
						_t198[1] = _t198[0x20];
						 *_t198 = _t198[0x1c];
						_t148 = L1001EFD0(_t165, _t190, _t192, _t195);
						_t195 = _t148;
						if(_t148 < 0) {
							 *_t198 = _t190;
							L100265B0();
							goto L17;
						}
						if(( *(_t198[0xb] + 8) & 0x00000002) != 0) {
							_t181 =  *(_t198[0x1c] + 4);
							 *_t198 = _t181;
							_t198[1] = _t198[0x20];
							_t198[8] = _t181;
							E1001F0D0();
							__eflags = _t192 - 3;
							_t182 = _t198[8];
							if(_t192 <= 3) {
								_t198[2] = "Formats with a palette require a minimum alignment of 4\n";
								_t198[1] = 0x10;
								 *_t198 = 0;
								E10023A40();
								 *_t198 = _t190;
								L100265B0();
								goto L29;
							}
							__eflags = _t182;
							if(_t182 != 0) {
								_t170 =  *(_t198[0x1c]);
								_t183 = _t182 - _t170;
								_t159 = _t198[0x1f] *  *_t165;
								__eflags = _t183 - _t159;
								if(_t183 > _t159) {
									_t191 = _t170 + _t159;
									_t184 = _t183 - _t159;
									__eflags = _t184 - 8;
									if(_t184 >= 8) {
										__eflags = _t191 & 0x00000001;
										if((_t191 & 0x00000001) != 0) {
											 *_t191 = 0;
											_t184 = _t184 - 1;
											_t191 = _t191 + 1;
										}
										__eflags = _t191 & 0x00000002;
										if((_t191 & 0x00000002) != 0) {
											 *_t191 = 0;
											_t184 = _t184 - 2;
											_t191 = _t191 + 2;
										}
										__eflags = _t191 & 0x00000004;
										if((_t191 & 0x00000004) != 0) {
											 *_t191 = 0;
											_t184 = _t184 - 4;
											_t191 = _t191 + 4;
										}
										_t172 = _t184 >> 2;
										_t184 = _t184 & 0x00000003;
										memset(_t191, 0, _t172 << 2);
										_t198 =  &(_t198[3]);
										_t191 = _t191 + _t172;
									}
									__eflags = _t184 & 0x00000004;
									if((_t184 & 0x00000004) != 0) {
										 *_t191 = 0;
										_t191 = _t191 + 4;
										__eflags = _t191;
									}
									__eflags = _t184 & 0x00000002;
									if((_t184 & 0x00000002) != 0) {
										 *_t191 = 0;
										_t191 = _t191 + 2;
										__eflags = _t191;
									}
									__eflags = _t184 & 0x00000001;
									if((_t184 & 0x00000001) != 0) {
										 *_t191 = 0;
									}
								}
							}
						}
						goto L17;
					}
				}
			}

0x1001f200
0x1001f204
0x1001f20e
0x1001f212
0x1001f216
0x1001f21d
0x1001f220
0x1001f225
0x1001f229
0x1001f22b
0x1001f4aa
0x1001f4aa
0x00000000
0x1001f231
0x1001f231
0x1001f23c
0x1001f242
0x1001f248
0x1001f24c
0x1001f253
0x1001f259
0x1001f25e
0x1001f261
0x1001f263
0x1001f269
0x1001f26d
0x1001f26d
0x1001f275
0x1001f279
0x1001f27d
0x1001f280
0x1001f290
0x1001f480
0x1001f480
0x1001f488
0x1001f491
0x1001f49a
0x1001f4a2
0x1001f4a5
0x00000000
0x1001f4a5
0x1001f2aa
0x1001f2ac
0x00000000
0x00000000
0x1001f2d0
0x1001f2d2
0x00000000
0x00000000
0x1001f2db
0x1001f2e0
0x1001f2e0
0x1001f2e3
0x1001f2e3
0x1001f2e5
0x1001f2f0
0x1001f2f3
0x1001f2f7
0x1001f2fc
0x1001f2fe
0x1001f300
0x1001f3ed
0x1001f3f6
0x1001f306
0x1001f30a
0x1001f30f
0x1001f311
0x1001f313
0x1001f31d
0x1001f31f
0x1001f322
0x1001f32c
0x1001f32e
0x1001f331
0x1001f33b
0x1001f33d
0x1001f340
0x1001f348
0x1001f350
0x1001f35b
0x1001f363
0x1001f366
0x1001f36d
0x1001f36f
0x00000000
0x00000000
0x1001f373
0x1001f377
0x00000000
0x00000000
0x1001f37d
0x1001f381
0x00000000
0x00000000
0x1001f387
0x1001f38b
0x00000000
0x00000000
0x1001f391
0x1001f395
0x00000000
0x00000000
0x1001f39b
0x1001f39e
0x1001f3a5
0x1001f3a7
0x1001f537
0x00000000
0x1001f537
0x1001f3ad
0x1001f3b5
0x1001f3b9
0x1001f3c4
0x1001f3cc
0x1001f3cf
0x1001f3d6
0x1001f3d8
0x1001f4b8
0x1001f4bb
0x00000000
0x1001f4bb
0x1001f3eb
0x1001f404
0x1001f40e
0x1001f411
0x1001f415
0x1001f419
0x1001f41e
0x1001f421
0x1001f425
0x1001f510
0x1001f51a
0x1001f522
0x1001f525
0x1001f52a
0x1001f52d
0x00000000
0x1001f52d
0x1001f42b
0x1001f42d
0x1001f435
0x1001f43b
0x1001f43d
0x1001f440
0x1001f442
0x1001f444
0x1001f447
0x1001f449
0x1001f44c
0x1001f4c5
0x1001f4cb
0x1001f4ee
0x1001f4f1
0x1001f4f2
0x1001f4f2
0x1001f4cd
0x1001f4d3
0x1001f503
0x1001f508
0x1001f50b
0x1001f50b
0x1001f4d5
0x1001f4db
0x1001f4f5
0x1001f4fb
0x1001f4fe
0x1001f4fe
0x1001f4e1
0x1001f4e4
0x1001f4e7
0x1001f4e7
0x1001f4e7
0x1001f4e7
0x1001f44e
0x1001f451
0x1001f453
0x1001f459
0x1001f459
0x1001f459
0x1001f45c
0x1001f45f
0x1001f461
0x1001f466
0x1001f466
0x1001f466
0x1001f469
0x1001f46c
0x1001f472
0x1001f472
0x1001f46c
0x1001f442
0x1001f42d
0x00000000
0x1001f3eb
0x1001f300

APIs

mv_pix_fmt_desc_get.MAIN ref: 1001F220
mv_image_get_linesize.MAIN ref: 1001F259

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_image_fill_linesizes.MAIN(?), ref: 1001F2F7
mv_image_fill_plane_sizes.MAIN(?), ref: 1001F366
mv_malloc.MAIN(?), ref: 1001F39E
mv_image_fill_pointers.MAIN(?), ref: 1001F3CF

Part of subcall function 1001EFD0: mv_image_fill_plane_sizes.MAIN ref: 1001F040

mvpriv_set_systematic_pal2.MAIN(?), ref: 1001F419

Strings

Picture size %ux%u is invalid, xrefs: 1001F48C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_fill_plane_sizesmv_pix_fmt_desc_get$mv_image_fill_linesizesmv_image_fill_pointersmv_image_get_linesizemv_mallocmvpriv_set_systematic_pal2
String ID: Picture size %ux%u is invalid
API String ID: 3240037220-1963597007
Opcode ID: 677e3105d86441c919a6bb07a2d9eb729f5658238c16f65244001bb42f50e7cb
Instruction ID: 41a0369190cf79952ebc4083191ebf048a4207412b4fff0bffc105f261d70811
Opcode Fuzzy Hash: 677e3105d86441c919a6bb07a2d9eb729f5658238c16f65244001bb42f50e7cb
Instruction Fuzzy Hash: 39911576A087418FC350DF28C48572BBBE2FF98354F15892DE9A8CB355EB35D9808B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002E2A5 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E1002E2A5(void* __ecx, void* __fp0, intOrPtr* _a4, signed int _a8, signed int _a12, intOrPtr* _a16, char _a20, signed int _a24) {
				char _v1052;
				char _v1056;
				char _v1057;
				char _v1058;
				signed int _v1059;
				char _v1072;
				signed int _v1076;
				signed int _v1080;
				intOrPtr _v1100;
				char* _v1104;
				char* _v1108;
				void* _v1112;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t84;
				void* _t89;
				intOrPtr _t96;
				char _t118;
				void* _t119;
				intOrPtr _t120;
				void* _t122;
				intOrPtr _t125;
				signed int _t128;
				intOrPtr _t131;
				signed int _t134;
				signed int _t135;
				intOrPtr* _t136;
				signed int _t137;
				signed int _t139;
				void* _t140;
				intOrPtr* _t141;
				void* _t168;

				_t168 = __fp0;
				_t141 = _t140 - 0x44c;
				_t128 = _a24;
				_t118 = _a20;
				_v1057 = 0;
				_t137 = _a8;
				_t134 = _a12;
				_v1076 = _t128;
				_v1072 = _t118;
				_v1059 = _t128;
				_v1058 = _t118;
				if(_t128 == 0 || _t118 == 0 || (_t128 & 0xffffff00 | _t128 == 0x0000005c | _t128 & 0xffffff00 | _t128 == _t118) != 0 || _t118 == 0x5c) {
					_v1108 = "Invalid separator(s) found.";
					_v1112 = 0x10;
					 *_t141 = _a4;
					E10023A40();
					goto L34;
				} else {
					if(_a4 == 0 || _a16 == 0) {
						L34:
						_t119 = 0xffffffea;
						goto L30;
					} else {
						_t135 = _t134 & 0x00000001;
						_t139 = _t134 & 0x00000002;
						_t120 = 0;
						 *_a16 = 0;
						_v1108 = 0xffffffff;
						_v1112 = 0x40;
						 *_t141 =  &_v1052;
						E10008880(0, _t135, _t137, _t139);
						_v1080 = _t135;
						_t136 = 0;
						_t125 =  *_a4;
						L7:
						while(1) {
							L7:
							while(1) {
								L7:
								while(1) {
									if(_t136 != 0) {
										L23:
										_t131 =  *((intOrPtr*)(_t136 + 0x30));
										if(_t131 == 0) {
											goto L29;
										} else {
											_t136 = _t136 + 0x30;
											goto L11;
										}
									} else {
										L8:
										if(_t125 == 0) {
											if(_t136 != 0) {
												goto L23;
											} else {
												goto L29;
											}
										} else {
											_t136 =  *((intOrPtr*)(_t125 + 8));
											if(_t136 == 0) {
												L29:
												_v1112 = _a16;
												 *_t141 =  &_v1052;
												_t119 =  <=  ? E10009690(_t120, _t125, _t136, _t137) : 0;
												L30:
												return _t119;
											} else {
												_t131 =  *_t136;
												if(_t131 == 0) {
													goto L29;
												} else {
													L11:
													if( *((intOrPtr*)(_t136 + 0xc)) == 0xa) {
														continue;
													} else {
														_t84 =  *(_t136 + 0x28);
														if(_t139 == 0) {
															if((_t84 & _t137) != _t137) {
																continue;
															} else {
																goto L14;
															}
														} else {
															if(_t137 != _t84) {
																continue;
															} else {
																L14:
																if(_v1080 == 0) {
																	L17:
																	_v1112 = _t131;
																	_v1104 =  &_v1056;
																	_v1108 = 0;
																	 *_t141 = _a4;
																	_t89 = E1002AD50(_t120, _t136, _t137, _t139);
																	if(_t89 < 0) {
																		_t122 = _t89;
																		_v1112 = 0;
																		 *_t141 =  &_v1052;
																		E10009690(_t122, 0, _t136, _t137);
																		return _t122;
																	} else {
																		if(_v1056 != 0) {
																			_t96 = _t120;
																			_t120 = _t120 + 1;
																			if(_t96 != 0) {
																				_v1108 = 1;
																				_v1112 =  &_v1076;
																				 *_t141 =  &_v1052;
																				L10008F30();
																			}
																			_v1100 = 0;
																			_v1104 = 1;
																			_v1108 =  &_v1059;
																			_v1112 =  *_t136;
																			 *_t141 =  &_v1052;
																			E10009730();
																			_v1112 =  &_v1072;
																			_v1108 = 1;
																			 *_t141 =  &_v1052;
																			L10008F30();
																			_v1100 = 0;
																			_v1104 = 1;
																			_v1108 =  &_v1059;
																			_v1112 = _v1056;
																			 *_t141 =  &_v1052;
																			E10009730();
																			 *_t141 =  &_v1056;
																			E100265C0();
																		}
																		goto L21;
																	}
																} else {
																	_v1112 = _t136;
																	 *_t141 = _a4;
																	if(E1002DCE0(_t120, _t125, _t136, _t137, _t139, _t168) > 0) {
																		L21:
																		_t125 =  *_a4;
																		if(_t136 == 0) {
																			goto L8;
																		} else {
																			goto L23;
																		}
																	} else {
																		_t131 =  *_t136;
																		goto L17;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									goto L35;
								}
							}
						}
					}
				}
				L35:
			}

0x1002e2a5
0x1002e2b4
0x1002e2ba
0x1002e2c1
0x1002e2c8
0x1002e2cd
0x1002e2d4
0x1002e2db
0x1002e2e1
0x1002e2e5
0x1002e2e9
0x1002e2ed
0x1002e56a
0x1002e56e
0x1002e572
0x1002e575
0x00000000
0x1002e318
0x1002e321
0x1002e57a
0x1002e57a
0x00000000
0x1002e336
0x1002e33f
0x1002e342
0x1002e345
0x1002e347
0x1002e352
0x1002e35b
0x1002e363
0x1002e366
0x1002e372
0x1002e376
0x1002e378
0x00000000
0x1002e380
0x00000000
0x1002e380
0x00000000
0x1002e380
0x1002e382
0x1002e4b0
0x1002e4b0
0x1002e4b5
0x00000000
0x1002e4b7
0x1002e4b7
0x00000000
0x1002e4b7
0x1002e388
0x1002e388
0x1002e38a
0x1002e4d2
0x00000000
0x00000000
0x00000000
0x00000000
0x1002e390
0x1002e390
0x1002e395
0x1002e4e0
0x1002e4e7
0x1002e4ef
0x1002e4fd
0x1002e500
0x1002e50c
0x1002e39b
0x1002e39b
0x1002e39f
0x00000000
0x1002e3a5
0x1002e3a5
0x1002e3a9
0x00000000
0x1002e3ab
0x1002e3ad
0x1002e3b0
0x1002e4c4
0x00000000
0x1002e4ca
0x00000000
0x1002e4ca
0x1002e3b6
0x1002e3b8
0x00000000
0x1002e3ba
0x1002e3ba
0x1002e3c0
0x1002e3df
0x1002e3df
0x1002e3e9
0x1002e3f4
0x1002e3f8
0x1002e3fb
0x1002e402
0x1002e538
0x1002e53c
0x1002e544
0x1002e547
0x1002e558
0x1002e408
0x1002e40e
0x1002e414
0x1002e416
0x1002e41b
0x1002e515
0x1002e51d
0x1002e525
0x1002e528
0x1002e528
0x1002e428
0x1002e430
0x1002e434
0x1002e43a
0x1002e442
0x1002e445
0x1002e453
0x1002e45b
0x1002e45f
0x1002e462
0x1002e469
0x1002e472
0x1002e47a
0x1002e482
0x1002e48a
0x1002e48d
0x1002e496
0x1002e499
0x1002e499
0x00000000
0x1002e40e
0x1002e3c2
0x1002e3c2
0x1002e3cd
0x1002e3d7
0x1002e49e
0x1002e4a7
0x1002e4a9
0x00000000
0x00000000
0x00000000
0x00000000
0x1002e3dd
0x1002e3dd
0x00000000
0x1002e3dd
0x1002e3d7
0x1002e3c0
0x1002e3b8
0x1002e3b0
0x1002e3a9
0x1002e39f
0x1002e395
0x1002e38a
0x00000000
0x1002e382
0x1002e380
0x1002e380
0x1002e380
0x1002e321
0x00000000

APIs

mv_bprint_init.MAIN ref: 1002E366
mv_opt_is_set_to_default.MAIN ref: 1002E3D0
mv_opt_get.MAIN ref: 1002E3FB
mv_bprint_escape.MAIN ref: 1002E445
mv_bprint_append_data.MAIN ref: 1002E462
mv_bprint_escape.MAIN ref: 1002E48D
mv_freep.MAIN ref: 1002E499
mv_bprint_finalize.MAIN ref: 1002E4F2
mv_log.MAIN ref: 1002E575

Strings

Invalid separator(s) found., xrefs: 1002E560

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_escape$mv_bprint_append_datamv_bprint_finalizemv_bprint_initmv_freepmv_logmv_opt_getmv_opt_is_set_to_default
String ID: Invalid separator(s) found.
API String ID: 350117393-2087347751
Opcode ID: ced0a989e3125253dd28f18aa86190e22e38fd0a67e20fb3db2e57ccf5a3ca8b
Instruction ID: be32556558566da91918c2a680401ca33f3fbc8414c6347af4aa08559a4ec22a
Opcode Fuzzy Hash: ced0a989e3125253dd28f18aa86190e22e38fd0a67e20fb3db2e57ccf5a3ca8b
Instruction Fuzzy Hash: 627144B5A497818FD750DF28D48069BBBE5FF89384F85892EE998C3301E735ED048B42

Uniqueness

Uniqueness Score: -1.00%

Function 10022C90 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

SetConsoleTextAttribute.KERNEL32 ref: 10022CFC

Part of subcall function 10022B20: WriteConsoleW.KERNEL32 ref: 10022BED

SetConsoleTextAttribute.KERNEL32 ref: 10022D1B
getenv.MSVCRT ref: 10022D6F
GetStdHandle.KERNEL32 ref: 10022D7D
GetConsoleMode.KERNEL32 ref: 10022D9B
GetConsoleScreenBufferInfo.KERNEL32 ref: 10022DC1
getenv.MSVCRT ref: 10022DE7
getenv.MSVCRT ref: 10022E04

Strings

256color, xrefs: 10022E93

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Console$getenv$AttributeText$BufferHandleInfoModeScreenWrite
String ID: 256color
API String ID: 1581660180-717642456
Opcode ID: e7ced9f8c13f53d067fcef4ee251cdf9dbc4f08a7fc86bd98f22f87c45c95b6c
Instruction ID: 44804557c579f2455f9cef449c3a7be8c99be238353a81a58ee82e3de595491c
Opcode Fuzzy Hash: e7ced9f8c13f53d067fcef4ee251cdf9dbc4f08a7fc86bd98f22f87c45c95b6c
Instruction Fuzzy Hash: 207169B4908351EBD710EF69D58412ABBE1FF94351F928A2EECD487390E7789840EB52

Uniqueness

Uniqueness Score: -1.00%

Function 1002F204 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1002F204(void* __ebx, void* __edx, void* __eflags) {
				signed int _t204;
				void* _t205;
				signed int _t210;
				signed int* _t217;
				void* _t220;
				void* _t225;
				signed int _t226;
				signed int _t232;
				void* _t239;
				signed int _t242;
				signed int _t245;
				signed int _t246;
				signed int _t248;
				void* _t250;

				__eax = E1004B090(__ebx, __eflags);
				__esp[1] = __edx;
				__esi = __eax;
				__eax = 0xf4240;
				__esp[2] = 0xf4240;
				__eax = 0;
				__edi = __edx;
				__esp[3] = 0;
				 *__esp = __esi;
				__eax = L1008EDE0();
				 *__esp = __ebp;
				__esp[0xe] = __eax;
				__eax = 0x100b4c2e;
				__esp[1] = 0x100b4c2e;
				__esp[0xf] = __edx;
				__eax = E10006B30();
				__eflags = __eax;
				if(__eax == 0) {
					L39:
					_t217 =  *(_t250 + 0xd0);
					 *_t217 = _t246;
					_t217[1] = _t242;
					_t205 = 0;
					goto L40;
				} else {
					__esp[2] = __ebx;
					__eax = "%Y - %m - %d";
					__esp[1] = "%Y - %m - %d";
					 *__esp = __ebp;
					__eax = E1002EC70();
					__eflags = __eax;
					if(__eax != 0) {
						__edi = 0;
						__ebp = __eax;
						__esp[0xb] = 0;
					} else {
						 *__esp = __ebp;
						__eax = "%Y%m%d";
						__esp[2] = __ebx;
						__esp[1] = "%Y%m%d";
						__eax = E1002EC70();
						__eflags = __eax - 1;
						asm("sbb edi, edi");
						__edi = __edi & 0x00000001;
						__eflags = __eax;
						__esp[0xb] = __edi;
						__ebp =  !=  ? __eax : __ebp;
					}
					__eax =  *__ebp & 0x000000ff;
					__eflags = (__al & 0x000000df) - 0x54;
					if((__al & 0x000000df) == 0x54) {
						__ebp =  &(__ebp[1]);
					} else {
						while(1) {
							__eflags = __al - 9 - 4;
							if(__al - 9 <= 4) {
								goto L41;
							}
							__eflags = __al - 0x20;
							if(__al == 0x20) {
								goto L41;
							}
							goto L12;
							L41:
							__ebp =  &(__ebp[1]);
							__eax =  *__ebp & 0x000000ff;
						}
					}
					L12:
					__esp[2] = __ebx;
					__esi = "%H:%M:%S";
					__esp[1] = "%H:%M:%S";
					 *__esp = __ebp;
					__eax = E1002EC70();
					__eflags = __eax;
					__edx = __eax;
					if(__eax != 0) {
						L14:
						__eax =  *__edx & 0x000000ff;
						__ecx = 0;
						__esp[9] = 0;
						__eflags = __al - 0x2e;
						if(__al == 0x2e) {
							__esp[0xa] = 0;
							__ecx = __edx;
							__edx = __ecx[1];
							__eax = __edx;
							__edx = __edx - 0x30;
							__eflags = __edx - 9;
							if(__edx > 9) {
								_t171 =  &(__ecx[1]); // 0x1
								__edx = _t171;
								__ebp = 0;
							} else {
								__ebp = __edx * 0x186a0;
								__edx = __ecx[2];
								__eax = __edx;
								__edx = __edx - 0x30;
								__eflags = __edx - 9;
								if(__edx > 9) {
									_t172 =  &(__ecx[2]); // 0x2
									__edx = _t172;
								} else {
									__ebp =  &(__ebp[__edx]);
									__edx = __ecx[3];
									__eax = __edx;
									__edx = __edx - 0x30;
									__eflags = __edx - 9;
									if(__edx > 9) {
										_t173 =  &(__ecx[3]); // 0x3
										__edx = _t173;
									} else {
										__ebp =  &(__ebp[__edx]);
										__edx = __ecx[4];
										__eax = __edx;
										__edx = __edx - 0x30;
										__eflags = __edx - 9;
										if(__edx > 9) {
											_t174 =  &(__ecx[4]); // 0x4
											__edx = _t174;
										} else {
											__eax = __edx + __edx * 4;
											__edx = __ecx[5];
											__ebp = __ebp + __eax * 4;
											__eax = __edx;
											__edx = __edx - 0x30;
											__eflags = __edx - 9;
											if(__edx > 9) {
												_t175 =  &(__ecx[5]); // 0x5
												__edx = _t175;
											} else {
												__eax = __edx + __edx * 4;
												__edx = __ecx[6];
												__ebp = __ebp + __eax * 2;
												__eax = __edx;
												__edx = __edx - 0x30;
												__eflags = __edx - 9;
												if(__edx > 9) {
													_t176 =  &(__ecx[6]); // 0x6
													__edx = _t176;
												} else {
													__ebp =  &(__ebp[__edx]);
													_t35 =  &(__ecx[7]); // 0x7
													__edx = _t35;
													__ecx = __ecx[7];
													__eax = __ecx;
													__ecx = __ecx - 0x30;
													__eflags = __ecx - 9;
													while(__ecx <= 9) {
														__ecx =  *(__edx + 1);
														__edx = __edx + 1;
														__eax = __ecx;
														__ecx = __ecx - 0x30;
														__eflags = __ecx - 9;
													}
												}
											}
										}
									}
								}
							}
							__esi = __esp[0x36];
							__eflags = __esp[0x36];
							if(__esp[0x36] != 0) {
								__ecx = __edx;
								if(_t204 == 0x6d) {
									__eflags =  *(_t225 + 1) - 0x73;
									if( *(_t225 + 1) != 0x73) {
										goto L63;
									} else {
										_t239 = 0x5a1cac09;
										_t204 =  *(_t225 + 2) & 0x000000ff;
										_t220 = 0xa5e353f7;
										_t226 = 0x3e8;
										_t248 = 0x10624dd3 * _t248 >> 0x20 >> 6;
										goto L31;
									}
								} else {
									if(_t204 == 0x75) {
										__eflags =  *(_t225 + 1) - 0x73;
										if( *(_t225 + 1) == 0x73) {
											__eflags =  *(_t225 + 2);
											if( *(_t225 + 2) != 0) {
												goto L63;
											} else {
												_t245 = 0;
												_t242 = 0;
												goto L35;
											}
										} else {
											goto L63;
										}
									} else {
										if(_t204 == 0x73) {
											_t204 =  *(_t225 + 1) & 0x000000ff;
										}
										goto L30;
									}
								}
								goto L40;
							} else {
								goto L26;
							}
						} else {
							__esp[0xa] = 0;
							__ebp = 0;
							L26:
							__al = __al & 0x000000df;
							__eflags = __al - 0x5a;
							__ecx = __ecx & 0xffffff00 | __al == 0x0000005a;
							__edi = __cl & 0x000000ff;
							__ecx = __esp[0xb];
							__esi = __edx + __edi;
							__edi = __edi | __esp[0xb];
							__eflags = __edi;
							if(__edi != 0) {
								__edx = __esp[0xb];
								__eflags = __esp[0xb];
								if(__esp[0xb] == 0) {
									L50:
									__eax = 0;
									__esp[6] = 0;
									__eax = 0;
									__eflags = 0;
									__esp[7] = 0;
									goto L51;
								} else {
									__eflags = __al - 0x5a;
									__eax =  &(__esp[0xe]);
									__esp[1] =  &(__esp[0xe]);
									__eax =  &(__esp[0x1a]);
									 *__esp =  &(__esp[0x1a]);
									if(__al != 0x5a) {
										__eax =  *0x100aa0c4();
										__eflags = __eax;
										if(__eax != 0) {
											goto L86;
										} else {
											__eax = 0;
											__eflags = 0;
											do {
												__edx =  *(__esp + __eax + 0x68);
												 *(__esp + __eax + 0x8c) =  *(__esp + __eax + 0x68);
												__eax = __eax + 4;
												__eflags = __eax - 0x24;
											} while (__eax < 0x24);
											__eax = __esp[0x11];
											__esp[0x23] = __esp[0x11];
											__eax = __esp[0x12];
											__esp[0x24] = __esp[0x12];
											__eax = __esp[0x13];
											__esp[0x25] = __esp[0x13];
											__eax = 0;
											__eflags = 0;
											do {
												__edx =  *(__esp + __eax + 0x8c);
												 *(__esp + __eax + 0x44) = __edx;
												__eax = __eax + 4;
												__eflags = __eax - 0x24;
											} while (__eax < 0x24);
											goto L28;
										}
									} else {
										__eax =  *0x100aa0c8();
										__eflags = __eax;
										if(__eax != 0) {
											L86:
											__esi = 0;
											__ecx = 9;
											__edi =  &(__esp[0x23]);
											__eax = memcpy( &(__esp[0x23]), 0, 9 << 2);
											__edi = 0 + __ecx;
											__edi =  &(__ecx[0 + __ecx]);
											__ecx = 0;
											asm("ud2");
											_push(__ebp);
											_push(__edi);
											_push(0);
											_push(__ebx);
											__esp = __esp - 0xac;
											__ecx = __esp[0x33];
											__edi = __esp[0x30];
											__eax =  *__ecx & 0x000000ff;
											__eflags = __al - 0x3f;
											if(__al == 0x3f) {
												__eax = __ecx[1] & 0x000000ff;
												__ecx =  &(__ecx[1]);
												__eflags = __ecx;
											}
											__esi = __esp[0x31];
											__ebx =  &(__esp[8]);
											__esi = __esp[0x31] - 1;
											__eflags = __al;
											__esp[7] = __esp[0x31] - 1;
											__esi = __esp[0x32];
											if(__al == 0) {
												L100:
												__edx = __ebx;
												__eflags = __al - 0x3d;
												 *__ebx = 0;
												__ebp = __ecx;
												__edx = __edi;
												if(__al == 0x3d) {
													goto L102;
												}
											} else {
												L90:
												__eflags = __al - 0x3d;
												__edx = __ebx;
												if(__al == 0x3d) {
													goto L100;
												} else {
													while(1) {
														__eflags = __al - 0x26;
														if(__al == 0x26) {
															break;
														} else {
															goto L93;
														}
														while(1) {
															L93:
															__edx = __edx - __ebx;
															__eflags = __edx - __ebx - 0x7e;
															if(__edx - __ebx <= 0x7e) {
																break;
															}
															__eax = __ecx[1] & 0x000000ff;
															__ecx =  &(__ecx[1]);
															__eflags = __al;
															if(__al == 0) {
																L96:
																 *__edx = 0;
																__eflags = __al - 0x3d;
																__ebp = __ecx;
																__edx = __edi;
																if(__al == 0x3d) {
																	L102:
																	__eax =  &(__ecx[1]);
																	__ecx = __ecx[1] & 0x000000ff;
																	__eflags = __cl;
																	if(__cl == 0) {
																		L124:
																		__edx = __edi;
																		__ebp = __eax;
																	} else {
																		__eflags = __cl - 0x26;
																		if(__cl == 0x26) {
																			goto L124;
																		} else {
																			__esp[0x32] = __esi;
																			while(1) {
																				__esi = __esp[7];
																				__edx = __edx - __edi;
																				__eflags = __edx - __edi - __esp[7];
																				if(__edx - __edi >= __esp[7]) {
																					break;
																				}
																				__eflags = __cl - 0x2b;
																				if(__cl == 0x2b) {
																					__cl = 0x20;
																				}
																				 *__edx = __cl;
																				__ebp = __edx + 1;
																				__eax = __eax + 1;
																				__ecx =  *__eax & 0x000000ff;
																				__eflags = __cl;
																				if(__cl == 0) {
																					L123:
																					__edx = __ebp;
																					__esi = __esp[0x32];
																					__ebp = __eax;
																				} else {
																					__eflags = __cl - 0x26;
																					if(__cl == 0x26) {
																						goto L123;
																					} else {
																						__edx = __ebp;
																						continue;
																					}
																				}
																				goto L97;
																			}
																			__ebp = __eax + 1;
																			__eax =  *(__eax + 1) & 0x000000ff;
																			__esi = __esp[0x32];
																			__eflags = __al - 0x26;
																			if(__al != 0x26) {
																				__eflags = __al;
																				if(__al != 0) {
																					while(1) {
																						__eax = __ebp[1] & 0x000000ff;
																						__ebp =  &(__ebp[1]);
																						__eflags = __al;
																						if(__al == 0) {
																							break;
																						}
																						__eflags = __al - 0x26;
																						if(__al != 0x26) {
																							continue;
																						}
																						goto L97;
																					}
																				} else {
																				}
																			}
																		}
																	}
																}
															} else {
																__eflags = __al - 0x3d;
																if(__al == 0x3d) {
																	goto L96;
																} else {
																	__eflags = __al - 0x26;
																	if(__al != 0x26) {
																		continue;
																	} else {
																		goto L115;
																	}
																}
															}
															goto L97;
														}
														 *__edx = __al;
														__eax = __ecx[1] & 0x000000ff;
														__ecx =  &(__ecx[1]);
														__ebp = __edx + 1;
														__edx = __edx + 1;
														__eflags = __al - 0x3d;
														if(__al == 0x3d) {
															goto L96;
														} else {
															__eflags = __al;
															if(__al != 0) {
																continue;
															} else {
																goto L96;
															}
														}
														goto L97;
													}
													L115:
													 *__edx = 0;
													__ebp = __ecx;
													__edx = __edi;
												}
											}
											L97:
											 *__edx = 0;
											__eax = strcmp(__ebx, __esi);
											__eflags = __eax;
											if(__eax == 0) {
												__esp =  &(__esp[0x2b]);
												__eax = 1;
												_pop(__ebx);
												_pop(__esi);
												_pop(__edi);
												_pop(__ebp);
												return 1;
											} else {
												__eflags =  *__ebp - 0x26;
												if( *__ebp != 0x26) {
													__esp =  &(__esp[0x2b]);
													__eax = 0;
													__eflags = 0;
													_pop(__ebx);
													_pop(__esi);
													_pop(__edi);
													_pop(__ebp);
													return 0;
												} else {
													__eax = __ebp[1] & 0x000000ff;
													__ecx =  &(__ebp[1]);
													__eflags = __al;
													if(__al != 0) {
														goto L90;
													} else {
														goto L100;
													}
													goto L97;
												}
											}
										} else {
											__eax = 0;
											__eflags = 0;
											do {
												__edx =  *(__esp + __eax + 0x68);
												 *(__esp + __eax + 0x8c) =  *(__esp + __eax + 0x68);
												__eax = __eax + 4;
												__eflags = __eax - 0x24;
											} while (__eax < 0x24);
											__eax = __esp[0x11];
											__esp[0x23] = __esp[0x11];
											__eax = __esp[0x12];
											__esp[0x24] = __esp[0x12];
											__eax = __esp[0x13];
											__esp[0x25] = __esp[0x13];
											__eax = 0;
											__eflags = 0;
											do {
												__edx =  *(__esp + __eax + 0x8c);
												 *(__esp + __eax + 0x44) =  *(__esp + __eax + 0x8c);
												__eax = __eax + 4;
												__eflags = __eax - 0x24;
											} while (__eax < 0x24);
											goto L50;
										}
									}
								}
							} else {
								__eax =  *__esi & 0x000000ff;
								__al = __al - 0x2b;
								__eflags = __al & 0x000000fd;
								if((__al & 0x000000fd) == 0) {
									__ebx =  &(__esp[0x23]);
									__edx = 0;
									__eax = 0;
									__eflags = 0;
									do {
										 *(__esp + __eax + 0x8c) = 0;
										 *((intOrPtr*)(__esp + __eax + 0x90)) = 0;
										__eax = __eax + 8;
										__eflags = __eax - 0x20;
									} while (__eax < 0x20);
									__ebx[__eax] = 0;
									__eax = 0;
									__edx = 0x100b4c28;
									__eflags =  *__esi - 0x2b;
									__eax = 0 |  *__esi != 0x0000002b;
									__esi =  &(__esi[1]);
									__eflags = __esi;
									__esp[6] = __eax;
									while(1) {
										__esp[2] = __ebx;
										__esp[1] = __edx;
										 *__esp = __esi;
										__eax = E1002EC70();
										__eflags = __eax;
										if(__eax != 0) {
											break;
										}
										__edi = __edi + 1;
										__eflags = __edi - 3;
										if(__edi == 3) {
											goto L63;
										} else {
											__edx =  *(0x100b4c64 + __edi * 4);
											continue;
										}
										goto L40;
									}
									__ecx = __esp[0x25];
									__esi = __eax;
									__eax = __esp[6];
									__edx = (__ecx << 4) - __ecx;
									__ecx = __esp[0x24];
									__edx = __esp[0x24] + __edx * 4;
									__edx = __edx * __esp[6];
									__edx = __edx << 4;
									__eax = (__edx << 4) - __edx;
									__eax = (__edx << 4) - __edx << 2;
									__esp[6] = __eax;
									__esp[7] = __eax;
									L51:
									__edx = __esp[0x15];
									__eax = 0;
									__esp[0x19] = 0;
									__ecx = __esp[0x16];
									__edi = __esp[0x14];
									__eax = __edx + 1;
									__eflags = __eax - 2;
									if(__eax <= 2) {
										__eax = __edx + 0xd;
										__ecx =  &(__ecx[0x76b]);
									} else {
										__ecx =  &(__ecx[0x76c]);
										__eflags = __ecx;
									}
									__eax = __eax + __eax * 8;
									__edx = __eax;
									__edx = __eax << 4;
									__ebx = __eax + (__eax << 4) - 0x1c9;
									__eax = 0x66666667;
									__edx = 0x66666667 * __ebx >> 0x20;
									0x66666667 * __ebx = __ebx;
									__eax = __ebx >> 0x1f;
									__edx = 0x66666667 * __ebx >> 0x20 >> 1;
									__edx = (0x66666667 * __ebx >> 0x20 >> 1) - (__ebx >> 0x1f);
									__eax = __ecx + __ecx * 8;
									__eax = __ecx + (__ecx + __ecx * 8) * 8;
									__ebx = __edx + __edi;
									__ebx =  &((__edx + __edi)[__eax]);
									__eflags = __ecx;
									 &(__ecx[3]) =  >=  ? __ecx :  &(__ecx[3]);
									__eax = ( >=  ? __ecx :  &(__ecx[3])) >> 2;
									__ebx =  &(__ebx[( >=  ? __ecx :  &(__ecx[3])) >> 2]);
									__eax = 0x51eb851f;
									__edx = 0x51eb851f * __ecx >> 0x20;
									__eax = 0x51eb851f * __ecx;
									__ecx = __ecx >> 0x1f;
									__edi = __ecx;
									__eax = __edx;
									__eax = __edx >> 5;
									__edx = __edx >> 7;
									__edi = __ecx - __eax;
									__edi =  &(__ebx[__ecx - __eax]);
									__ebx = __esp[0x12];
									__eax = __edi + __edx - 0xafa6d;
									__edx = 0x15180;
									__edi = __esp[0x13] * 0xe10;
									__edx = __eax * 0x15180 >> 0x20;
									__eax = __eax * 0x15180;
									__ecx = (__ebx << 4) - __ebx;
									__ecx = __esp[0x13] * 0xe10 + ((__ebx << 4) - __ebx) * 4;
									__edi = __esp[0x11];
									__ecx =  &((__esp[0x13] * 0xe10 + ((__ebx << 4) - __ebx) * 4)[__esp[0x11]]);
									__ebx = __ecx;
									__ebx = __ecx >> 0x1f;
									__ecx =  &(__ecx[__eax]);
									asm("adc ebx, edx");
									__ecx =  &(__ecx[__esp[6]]);
									asm("adc ebx, [esp+0x1c]");
									__esp[6] = __ecx;
									__esp[7] = __ebx;
									goto L29;
								} else {
									L28:
									 *__esp = __ebx;
									__ecx = 0xffffffff;
									__esp[0x19] = 0xffffffff;
									__imp___mktime64();
									__esp[6] = __eax;
									__esp[7] = __edx;
									L29:
									__eax =  *__esi & 0x000000ff;
									L30:
									_t239 = 0x842fa50a;
									_t220 = 0x7bd05af6;
									_t226 = 0xf4240;
									L31:
									if(_t204 != 0) {
										goto L63;
									} else {
										asm("sbb edx, eax");
										if(_t220 <  *(_t250 + 0x18)) {
											L76:
											_t205 = 0xffffffde;
										} else {
											_t210 =  *(_t250 + 0x18);
											_t232 =  *(_t250 + 0x1c);
											asm("sbb edi, esi");
											if(_t210 < _t239) {
												goto L76;
											} else {
												_t245 = _t248;
												_t242 = _t248 >> 0x1f;
												 *(_t250 + 0x1c) = _t210 * _t226 >> 0x20;
												 *(_t250 + 0x1c) =  *(_t250 + 0x1c) + _t232 * _t226;
												 *(_t250 + 0x18) = _t210 * _t226;
												asm("sbb edx, edi");
												asm("sbb eax, ebx");
												if(0xffffffff - _t248 <  *(_t250 + 0x18)) {
													goto L76;
												} else {
													L35:
													_t246 = _t245 +  *(_t250 + 0x18);
													asm("adc edi, [esp+0x1c]");
													if((_t246 | _t242 + 0x80000000) != 0 ||  *((char*)(_t250 + 0x2b)) == 0) {
														if( *((intOrPtr*)(_t250 + 0x24)) != 0) {
															_t246 =  ~_t246;
															asm("adc edi, 0x0");
															_t242 =  ~_t242;
														}
														goto L39;
													} else {
														goto L76;
													}
												}
											}
										}
									}
								}
								goto L40;
							}
						}
					} else {
						__esp[2] = __ebx;
						__ecx = "%H%M%S";
						__esp[1] = "%H%M%S";
						 *__esp = __ebp;
						__eax = E1002EC70();
						__eflags = __eax;
						__edx = __eax;
						if(__eax == 0) {
							L63:
							_t205 = 0xffffffea;
							L40:
							return _t205;
						} else {
							goto L14;
						}
					}
				}
			}

0x1002f208
0x1002f20d
0x1002f211
0x1002f213
0x1002f218
0x1002f21c
0x1002f21e
0x1002f220
0x1002f224
0x1002f227
0x1002f22c
0x1002f22f
0x1002f233
0x1002f238
0x1002f23c
0x1002f240
0x1002f245
0x1002f247
0x1002f4e4
0x1002f4e4
0x1002f4eb
0x1002f4ed
0x1002f4f0
0x00000000
0x1002f24d
0x1002f24d
0x1002f251
0x1002f256
0x1002f25a
0x1002f25d
0x1002f262
0x1002f264
0x1002f8bd
0x1002f8bf
0x1002f8c1
0x1002f26a
0x1002f26a
0x1002f26d
0x1002f272
0x1002f276
0x1002f27a
0x1002f27f
0x1002f282
0x1002f284
0x1002f287
0x1002f289
0x1002f28d
0x1002f28d
0x1002f290
0x1002f299
0x1002f29c
0x1002f6c8
0x00000000
0x1002f2b0
0x1002f2b5
0x1002f2b8
0x00000000
0x00000000
0x1002f2be
0x1002f2c0
0x00000000
0x00000000
0x00000000
0x1002f500
0x1002f500
0x1002f501
0x1002f501
0x1002f2b0
0x1002f2c6
0x1002f2c6
0x1002f2ca
0x1002f2cf
0x1002f2d3
0x1002f2d6
0x1002f2db
0x1002f2dd
0x1002f2df
0x1002f300
0x1002f300
0x1002f303
0x1002f305
0x1002f309
0x1002f30b
0x1002f8d1
0x1002f8d6
0x1002f326
0x1002f32a
0x1002f32c
0x1002f32f
0x1002f332
0x1002f88a
0x1002f88a
0x1002f88d
0x1002f338
0x1002f338
0x1002f33e
0x1002f342
0x1002f344
0x1002f347
0x1002f34a
0x1002f894
0x1002f894
0x1002f350
0x1002f356
0x1002f358
0x1002f35c
0x1002f35e
0x1002f361
0x1002f364
0x1002f89c
0x1002f89c
0x1002f36a
0x1002f370
0x1002f372
0x1002f376
0x1002f378
0x1002f37b
0x1002f37e
0x1002f8a4
0x1002f8a4
0x1002f384
0x1002f384
0x1002f387
0x1002f38e
0x1002f392
0x1002f394
0x1002f397
0x1002f39a
0x1002f8ac
0x1002f8ac
0x1002f3a0
0x1002f3a0
0x1002f3a3
0x1002f3a7
0x1002f3ab
0x1002f3ad
0x1002f3b0
0x1002f3b3
0x1002f8b5
0x1002f8b5
0x1002f3b9
0x1002f3b9
0x1002f3bb
0x1002f3bb
0x1002f3be
0x1002f3c2
0x1002f3c4
0x1002f3c7
0x1002f3ca
0x1002f3d0
0x1002f3d4
0x1002f3d5
0x1002f3d7
0x1002f3da
0x1002f3da
0x1002f3ca
0x1002f3b3
0x1002f39a
0x1002f37e
0x1002f364
0x1002f34a
0x1002f3df
0x1002f3e6
0x1002f3e8
0x1002f8ca
0x1002f1cd
0x1002f6f0
0x1002f6f4
0x00000000
0x1002f6f6
0x1002f6fb
0x1002f707
0x1002f70b
0x1002f710
0x1002f718
0x00000000
0x1002f71a
0x1002f1d3
0x1002f1d5
0x1002f6d0
0x1002f6d4
0x1002f868
0x1002f86c
0x00000000
0x1002f872
0x1002f872
0x1002f874
0x00000000
0x1002f874
0x00000000
0x00000000
0x00000000
0x1002f1db
0x1002f1e0
0x1002f1e6
0x1002f1e6
0x00000000
0x1002f1e0
0x1002f1d5
0x00000000
0x00000000
0x00000000
0x00000000
0x1002f311
0x1002f311
0x1002f316
0x1002f3ee
0x1002f3ee
0x1002f3f0
0x1002f3f2
0x1002f3f5
0x1002f3f8
0x1002f3fc
0x1002f3ff
0x1002f3ff
0x1002f401
0x1002f510
0x1002f514
0x1002f516
0x1002f590
0x1002f590
0x1002f592
0x1002f596
0x1002f596
0x1002f598
0x00000000
0x1002f518
0x1002f518
0x1002f51a
0x1002f51e
0x1002f522
0x1002f526
0x1002f529
0x1002f7c8
0x1002f7ce
0x1002f7d0
0x00000000
0x1002f7d6
0x1002f7d6
0x1002f7d6
0x1002f7d8
0x1002f7d8
0x1002f7dc
0x1002f7e3
0x1002f7e6
0x1002f7e6
0x1002f7eb
0x1002f7ef
0x1002f7f6
0x1002f7fa
0x1002f801
0x1002f805
0x1002f80c
0x1002f80c
0x1002f80e
0x1002f80e
0x1002f815
0x1002f819
0x1002f81c
0x1002f81c
0x00000000
0x1002f821
0x1002f52f
0x1002f52f
0x1002f535
0x1002f537
0x1002f8dd
0x1002f8dd
0x1002f8df
0x1002f8e4
0x1002f8eb
0x1002f8eb
0x1002f8eb
0x1002f8eb
0x1002f8ed
0x1002f8f0
0x1002f8f1
0x1002f8f2
0x1002f8f3
0x1002f8f4
0x1002f8fa
0x1002f901
0x1002f908
0x1002f90b
0x1002f90d
0x1002f90f
0x1002f913
0x1002f913
0x1002f913
0x1002f914
0x1002f91b
0x1002f91f
0x1002f920
0x1002f922
0x1002f926
0x1002f92d
0x1002f9a0
0x1002f9a0
0x1002f9a2
0x1002f9a4
0x1002f9a7
0x1002f9a9
0x1002f9ab
0x00000000
0x00000000
0x1002f930
0x1002f930
0x1002f930
0x1002f932
0x1002f934
0x00000000
0x1002f940
0x1002f940
0x1002f940
0x1002f942
0x00000000
0x00000000
0x00000000
0x00000000
0x1002f948
0x1002f948
0x1002f94a
0x1002f94c
0x1002f94f
0x00000000
0x00000000
0x1002fa10
0x1002fa14
0x1002fa15
0x1002fa17
0x1002f969
0x1002f969
0x1002f96c
0x1002f96e
0x1002f970
0x1002f972
0x1002f9b0
0x1002f9b0
0x1002f9b3
0x1002f9b7
0x1002f9b9
0x1002fa8d
0x1002fa8d
0x1002fa8f
0x1002f9bf
0x1002f9bf
0x1002f9c2
0x00000000
0x1002f9c8
0x1002f9c8
0x1002f9cf
0x1002f9cf
0x1002f9d5
0x1002f9d7
0x1002f9d9
0x00000000
0x00000000
0x1002fa40
0x1002fa43
0x1002fa45
0x1002fa45
0x1002fa47
0x1002fa49
0x1002fa4c
0x1002fa4d
0x1002fa50
0x1002fa52
0x1002fa7d
0x1002fa7d
0x1002fa7f
0x1002fa86
0x1002fa54
0x1002fa54
0x1002fa57
0x00000000
0x1002fa59
0x1002fa59
0x00000000
0x1002fa59
0x1002fa57
0x00000000
0x1002fa52
0x1002f9db
0x1002f9de
0x1002f9e2
0x1002f9e9
0x1002f9eb
0x1002f9ed
0x1002f9ef
0x1002fa00
0x1002fa00
0x1002fa04
0x1002fa05
0x1002fa07
0x00000000
0x00000000
0x1002f9f8
0x1002f9fa
0x00000000
0x00000000
0x00000000
0x1002f9fa
0x00000000
0x1002f9f1
0x1002f9ef
0x1002f9eb
0x1002f9c2
0x1002f9b9
0x1002fa1d
0x1002fa1d
0x1002fa20
0x00000000
0x1002fa26
0x1002fa26
0x1002fa28
0x00000000
0x00000000
0x00000000
0x00000000
0x1002fa28
0x1002fa20
0x00000000
0x1002fa17
0x1002f955
0x1002f957
0x1002f95b
0x1002f95c
0x1002f95f
0x1002f961
0x1002f963
0x00000000
0x1002f965
0x1002f965
0x1002f967
0x00000000
0x00000000
0x00000000
0x00000000
0x1002f967
0x00000000
0x1002f963
0x1002fa2e
0x1002fa2e
0x1002fa31
0x1002fa33
0x1002fa33
0x1002f934
0x1002f974
0x1002f974
0x1002f97e
0x1002f983
0x1002f985
0x1002fa60
0x1002fa66
0x1002fa6b
0x1002fa6c
0x1002fa6d
0x1002fa6e
0x1002fa6f
0x1002f98b
0x1002f98b
0x1002f98f
0x1002fa70
0x1002fa76
0x1002fa76
0x1002fa78
0x1002fa79
0x1002fa7a
0x1002fa7b
0x1002fa7c
0x1002f995
0x1002f995
0x1002f999
0x1002f99c
0x1002f99e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1002f99e
0x1002f98f
0x1002f53d
0x1002f53d
0x1002f53d
0x1002f53f
0x1002f53f
0x1002f543
0x1002f54a
0x1002f54d
0x1002f54d
0x1002f552
0x1002f556
0x1002f55d
0x1002f561
0x1002f568
0x1002f56c
0x1002f573
0x1002f573
0x1002f575
0x1002f575
0x1002f57c
0x1002f580
0x1002f583
0x1002f583
0x00000000
0x1002f575
0x1002f537
0x1002f529
0x1002f407
0x1002f407
0x1002f40a
0x1002f40c
0x1002f40e
0x1002f660
0x1002f667
0x1002f669
0x1002f669
0x1002f66b
0x1002f66b
0x1002f672
0x1002f679
0x1002f67c
0x1002f67c
0x1002f681
0x1002f688
0x1002f68a
0x1002f68f
0x1002f692
0x1002f695
0x1002f695
0x1002f69a
0x1002f69e
0x1002f69e
0x1002f6a2
0x1002f6a6
0x1002f6a9
0x1002f6ae
0x1002f6b0
0x00000000
0x00000000
0x1002f6b6
0x1002f6b7
0x1002f6ba
0x00000000
0x1002f6bc
0x1002f6bc
0x00000000
0x1002f6bc
0x00000000
0x1002f6ba
0x1002f826
0x1002f82d
0x1002f82f
0x1002f838
0x1002f83a
0x1002f841
0x1002f844
0x1002f849
0x1002f84c
0x1002f84e
0x1002f851
0x1002f858
0x1002f59c
0x1002f59c
0x1002f5a0
0x1002f5a2
0x1002f5a6
0x1002f5aa
0x1002f5ae
0x1002f5b1
0x1002f5b4
0x1002f728
0x1002f72b
0x1002f5ba
0x1002f5ba
0x1002f5ba
0x1002f5ba
0x1002f5c0
0x1002f5c3
0x1002f5c5
0x1002f5c8
0x1002f5cf
0x1002f5d4
0x1002f5d6
0x1002f5d8
0x1002f5db
0x1002f5dd
0x1002f5df
0x1002f5e2
0x1002f5e5
0x1002f5eb
0x1002f5ed
0x1002f5f2
0x1002f5f5
0x1002f5f8
0x1002f5fa
0x1002f5ff
0x1002f5ff
0x1002f601
0x1002f604
0x1002f606
0x1002f608
0x1002f60b
0x1002f60e
0x1002f610
0x1002f612
0x1002f618
0x1002f61f
0x1002f624
0x1002f62c
0x1002f62c
0x1002f633
0x1002f635
0x1002f638
0x1002f63c
0x1002f63e
0x1002f640
0x1002f643
0x1002f645
0x1002f647
0x1002f64b
0x1002f64f
0x1002f653
0x00000000
0x1002f414
0x1002f414
0x1002f414
0x1002f417
0x1002f41c
0x1002f420
0x1002f426
0x1002f42a
0x1002f42e
0x1002f42e
0x1002f431
0x1002f431
0x1002f43b
0x1002f445
0x1002f44a
0x1002f44c
0x00000000
0x1002f452
0x1002f45c
0x1002f45e
0x1002f880
0x1002f880
0x1002f464
0x1002f464
0x1002f468
0x1002f470
0x1002f472
0x00000000
0x1002f478
0x1002f47e
0x1002f483
0x1002f486
0x1002f48f
0x1002f493
0x1002f4a6
0x1002f4ac
0x1002f4ae
0x00000000
0x1002f4b4
0x1002f4b4
0x1002f4b4
0x1002f4b8
0x1002f4c8
0x1002f4db
0x1002f4dd
0x1002f4df
0x1002f4e2
0x1002f4e2
0x00000000
0x00000000
0x00000000
0x00000000
0x1002f4c8
0x1002f4ae
0x1002f472
0x1002f45e
0x1002f44c
0x00000000
0x1002f40e
0x1002f401
0x1002f2e1
0x1002f2e1
0x1002f2e5
0x1002f2ea
0x1002f2ee
0x1002f2f1
0x1002f2f6
0x1002f2f8
0x1002f2fa
0x1002f6e0
0x1002f6e0
0x1002f4f2
0x1002f4fc
0x00000000
0x00000000
0x00000000
0x1002f2fa
0x1002f2df

APIs

mv_gettime.MAIN ref: 1002F208
mv_strcasecmp.MAIN ref: 1002F240
mv_small_strptime.MAIN ref: 1002F25D
mv_small_strptime.MAIN ref: 1002F27A
mv_small_strptime.MAIN ref: 1002F2D6
mv_small_strptime.MAIN ref: 1002F2F1
_mktime64.MSVCRT ref: 1002F420

Strings

%Y - %m - %d, xrefs: 1002F251
%H:%M:%S, xrefs: 1002F2CA
%Y%m%d, xrefs: 1002F26D
%H%M%S, xrefs: 1002F2E5
now, xrefs: 1002F233

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_small_strptime$_mktime64mv_gettimemv_strcasecmp
String ID: %H%M%S$%H:%M:%S$%Y - %m - %d$%Y%m%d$now
API String ID: 3102546153-2275413634
Opcode ID: 3b59df7daf9013c20f7f9f6ddd4171326e91ec71721b8f1468b8232903dcc860
Instruction ID: 7f3ee14ce240381be5dd98d6c3d180aec0b6e0ebcf4911cbbe250e8a450d1d0f
Opcode Fuzzy Hash: 3b59df7daf9013c20f7f9f6ddd4171326e91ec71721b8f1468b8232903dcc860
Instruction Fuzzy Hash: F1518F75A083564FC344DF29948032AFBE1EFC8794F92893EE5D8C7391EA34D9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 10031953 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10031977
strcmp.MSVCRT ref: 1003198C
strcmp.MSVCRT ref: 100319DC

Strings

rgba, xrefs: 10031993
yuv420p, xrefs: 100319A0, 10031A24
bgra, xrefs: 100319F0
bgr32, xrefs: 10031983
%s%s, xrefs: 100319FC
rgb32, xrefs: 10031963

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp
String ID: %s%s$bgr32$bgra$rgb32$rgba$yuv420p
API String ID: 1004003707-3566121812
Opcode ID: 79744c2111bda5b6184e427c31998bbbd79b24246f6bed7c2faea8a5c1db962c
Instruction ID: 5e0aec2c4f91ad711b5a319ef5467e3120ddceac8a83d986c1d0e9bf290138ef
Opcode Fuzzy Hash: 79744c2111bda5b6184e427c31998bbbd79b24246f6bed7c2faea8a5c1db962c
Instruction Fuzzy Hash: FF317F79A087559BD711DF69888179EB6F4EF88282F02492EE8C8DB301E778D800DB42

Uniqueness

Uniqueness Score: -1.00%

Function 1004CCF9 Relevance: 19.8, APIs: 13, Instructions: 297COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: a4cfb47e0e14e20cdd003f70e4cf5779280a1b1b1a9cf85861452e91f4ec990a
Instruction ID: bc91240eb8339773c59cf6c55f5b209cd7f8f418b7580a3478e353fd1f6a44de
Opcode Fuzzy Hash: a4cfb47e0e14e20cdd003f70e4cf5779280a1b1b1a9cf85861452e91f4ec990a
Instruction Fuzzy Hash: A9D1C2B490974A9FC340DF5AC18091AFBE5FFC8654F61892EE888D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1004C82C Relevance: 19.8, APIs: 13, Instructions: 294COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: 95cf165c7df1e3b14e8353417eaf65eff3f766b1f1fabdb0d3657f97e4e1532e
Instruction ID: 92974a57f51364e3157bc9e69e38102b8c966e1fd57831e9c9b5ac2784e8d0df
Opcode Fuzzy Hash: 95cf165c7df1e3b14e8353417eaf65eff3f766b1f1fabdb0d3657f97e4e1532e
Instruction Fuzzy Hash: 1FC1C2B490974A9FC340DF6AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1004C877 Relevance: 19.8, APIs: 13, Instructions: 279COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: 5ba1de0a2128bb80714fc7f87f514a6120d16dbb4c6ec235376ab0e5548afddf
Instruction ID: 55863b4f0a31e834c219965d94d4823f7879c6ff1bed93916ad31882f3d71024
Opcode Fuzzy Hash: 5ba1de0a2128bb80714fc7f87f514a6120d16dbb4c6ec235376ab0e5548afddf
Instruction Fuzzy Hash: 8AC1D2B4909749AFC340DF6AC18091AFBE5FF88654F61892EE8D8D7311E734E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1001C870 Relevance: 19.7, APIs: 13, Instructions: 169COMMON

Download Yara Rule

APIs

mv_ripemd_init.MAIN ref: 1001C8DE
mv_ripemd_init.MAIN ref: 1001C8F6
mv_ripemd_init.MAIN ref: 1001C90E
mv_ripemd_init.MAIN ref: 1001C926
mv_sha_init.MAIN ref: 1001C93E
mv_sha_init.MAIN ref: 1001C95E
mv_sha_init.MAIN ref: 1001C97E
mv_sha512_init.MAIN ref: 1001C99E
mv_sha512_init.MAIN ref: 1001C9BE
mv_sha512_init.MAIN ref: 1001C9DE
mv_sha512_init.MAIN ref: 1001C9FE
mv_adler32_update.MAIN ref: 1001CA46
mv_crc.MAIN ref: 1001CAD5

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_ripemd_initmv_sha512_init$mv_sha_init$mv_adler32_updatemv_crc
String ID:
API String ID: 2533704273-0
Opcode ID: a5574497256713bb20ba09e0eacec7ebb4491d86d0e4b8baf7000fed20719829
Instruction ID: b4fd7817c68cc5ebcb381f62e52a11943eedc005ab1a14790db74db78419b9e7
Opcode Fuzzy Hash: a5574497256713bb20ba09e0eacec7ebb4491d86d0e4b8baf7000fed20719829
Instruction Fuzzy Hash: 8871AFB4909701DFC754DF68C08091ABBE0FF8D354F5489AEE9898B322E735D980EB56

Uniqueness

Uniqueness Score: -1.00%

Function 1009EC40 Relevance: 19.6, APIs: 13, Instructions: 147
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E1009EC40(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				void* _v16;
				long _v20;
				char* _v24;
				void* _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				long _t37;
				void* _t39;
				long _t40;
				void* _t44;
				void* _t45;
				long _t46;
				void* _t49;
				void* _t50;
				void* _t53;
				long* _t54;

				_t49 = __esi;
				_t45 = __ebx;
				if( *0x101d7228 == 1) {
					return _t37;
				} else {
					_push(__edi);
					__eax = 0x101d7228;
					_push(__esi);
					__esp = __esp - 0x10;
					__eax = E1009E5C0(0x101d7228, __eflags);
					_t9 = __eax + 4; // 0x4
					__esi = _t9;
					__ebx = __eax;
					 *__esp = __esi;
					__eax = E100A1540(__ebx);
					__edi =  *0x101d7228;
					__eflags = __edi;
					if(__edi != 0) {
						__eflags = __edi - 1;
						if(__edi == 1) {
							goto L18;
						} else {
							 *__esp = 2;
							__eax =  *0x100aa0cc();
							_v16 = __edi;
							_v20 = 0x101d7228;
							__eax = fprintf(__eax, " once %p is %d\n");
							__eax = E100A1880(__esi);
							__eflags = __ebx;
							if(__ebx != 0) {
								goto L19;
							} else {
								goto L22;
							}
						}
					} else {
						__eax = TlsAlloc();
						 *0x100aa0f0 = __eax;
						__eflags = __eax - 0xffffffff;
						if(__eflags == 0) {
							abort();
							while(1) {
								_push(__ebp);
								_push(__edi);
								_push(__esi);
								_push(__ebx);
								__esp = __esp - 0x2c;
								__eax = E1009E9C0(__eflags);
								__eflags =  *0x101df020;
								if( *0x101df020 == 0) {
									break;
								}
								__ebx = __eax;
								__eflags = __eax;
								if(__eax == 0) {
									break;
								} else {
									 *(__eax + 0x24) = 1;
									 *((intOrPtr*)(__ebx + 0x3c)) = GetCurrentThreadId();
									__eax = CreateEventA(0, 1, 0, 0);
									 *((intOrPtr*)(__ebx + 0x1c)) = 0xffffffff;
									 *(__ebx + 0x18) = __eax;
									__esp = __esp - 0x10;
									_t20 = __ebx + 0x38; // 0x38
									__eax = _t20;
									 *__esp = _t20;
									__eax = E100A2880();
									__eflags = __eax - 1;
									if(__eax == 1) {
										E1009E7E0();
										goto L33;
									} else {
										__ebp = GetCurrentProcess;
										 *(__ebx + 0x38) = 0xffffffff;
										 *(__ebx + 0x64) = 0;
										 *(__ebx + 0x14) = 0;
										__edi = GetCurrentProcess();
										__esi = GetCurrentThread();
										__eax = GetCurrentProcess();
										_t24 = __ebx + 0x14; // 0x14
										__eax = DuplicateHandle(__eax, __esi, __edi, _t24, 0, 0, 2);
										__esp = __esp - 0x1c;
										__eflags = __eax;
										if(__eax == 0) {
											L33:
											abort();
											__esp = __esp - 0x1c;
											__eax = E1009EC40(__ebx, __edi, __esi, __ebp);
											__eax =  *0x100aa0f0; // 0xffffffff
											__eax = TlsGetValue(__eax);
											__esp = __esp - 4;
											__eflags = __eax;
											if(__eflags == 0) {
												__esp =  &(__esp[7]);
												continue;
											} else {
												__esp =  &(__esp[7]);
												return __eax;
											}
										} else {
											__eax =  *(__ebx + 0x14);
											__eax = GetThreadPriority( *(__ebx + 0x14));
											 *(__ebx + 0x68) = 0;
											 *(__ebx + 0x6c) = __eax;
											__eax =  *(__ebx + 0x20) & 0x000000ff;
											__esp = __esp - 4;
											 *(__ebx + 0x20) & 0xcf =  *(__ebx + 0x20) & 0xcf | 0x00000010;
											 *(__ebx + 0x20) = __al;
											__eax =  *0x100aa0f0; // 0xffffffff
											__eax = TlsSetValue(__eax, __ebx);
											__esp = __esp - 8;
											__eflags = __eax;
											if(__eax == 0) {
												goto L33;
											} else {
												__esp =  &(__esp[0xb]);
												__eax = __ebx;
												_pop(__ebx);
												_pop(__esi);
												_pop(__edi);
												_pop(__ebp);
												return __ebx;
											}
										}
									}
								}
								goto L37;
							}
							__esp =  &(__esp[0xb]);
							__ebx = 0;
							__eflags = 0;
							__eax = 0;
							_pop(__ebx);
							_pop(__esi);
							_pop(__edi);
							_pop(__ebp);
							return 0;
						} else {
							 *0x101d7228 = 1;
							L18:
							__eax = E100A1880(__esi);
							__eflags = __ebx;
							if(__ebx == 0) {
								L22:
								__esp =  &(__esp[4]);
								_pop(__ebx);
								_pop(__esi);
								_pop(__edi);
								return __eax;
							} else {
								L19:
								__esp =  &(__esp[4]);
								__eax = __ebx;
								_pop(__ebx);
								_pop(__esi);
								_pop(__edi);
								_push(_t49);
								_t46 = _t37;
								_t54 = _t53 - 0x14;
								 *_t54 = 0x100aa0e4;
								E100A2890(_t45);
								_t39 =  *0x101d71fc;
								if(_t39 == 0 || _t39 == _t46) {
									_t50 = 0;
									goto L6;
								} else {
									while(1) {
										_t50 = _t39;
										_t39 =  *(_t39 + 0xc);
										if(_t39 == 0) {
											break;
										}
										if(_t39 != _t46) {
											continue;
										} else {
											L6:
											if(_t39 == 0) {
												break;
											} else {
												_t2 = _t46 + 8;
												 *_t2 =  *((intOrPtr*)(_t46 + 8)) - 1;
												if( *_t2 == 0) {
													 *_t54 = _t46 + 4;
													E100A1A00();
													_t44 =  *(_t46 + 0xc);
													__eflags = _t50;
													if(_t50 == 0) {
														 *0x101d71fc = _t44;
													} else {
														 *(_t50 + 0xc) = _t44;
													}
													 *_t54 = _t46;
													L1009DBE8();
												}
											}
										}
										goto L8;
									}
									 *_t54 = 2;
									_t40 =  *0x100aa0cc();
									_v20 = _t46;
									_v24 = "%p not found?!?!\n";
									 *_t54 = _t40;
									L100A3F78();
								}
								L8:
								 *_t54 = 0x100aa0e4;
								return E100A28E0();
							}
						}
					}
				}
				L37:
			}

0x1009ec40
0x1009ec40
0x1009ec47
0x1009ecf8
0x1009ec4d
0x1009ec4d
0x1009ec4e
0x1009ec53
0x1009ec55
0x1009ec58
0x1009ec5d
0x1009ec5d
0x1009ec60
0x1009ec62
0x1009ec65
0x1009ec6a
0x1009ec70
0x1009ec72
0x1009ecb0
0x1009ecb3
0x00000000
0x1009ecb5
0x1009ecb5
0x1009ecbc
0x1009ecc2
0x1009ecc6
0x1009ecd9
0x1009ece1
0x1009ece6
0x1009ece8
0x00000000
0x00000000
0x00000000
0x00000000
0x1009ece8
0x1009ec74
0x1009ec74
0x1009ec7a
0x1009ec7f
0x1009ec82
0x1009ecf9
0x1009ed00
0x1009ed00
0x1009ed01
0x1009ed02
0x1009ed03
0x1009ed04
0x1009ed07
0x1009ed12
0x1009ed14
0x00000000
0x00000000
0x1009ed1a
0x1009ed1c
0x1009ed1e
0x00000000
0x1009ed24
0x1009ed24
0x1009ed31
0x1009ed53
0x1009ed59
0x1009ed60
0x1009ed63
0x1009ed66
0x1009ed66
0x1009ed69
0x1009ed6c
0x1009ed71
0x1009ed74
0x1009ee34
0x00000000
0x1009ed7a
0x1009ed7a
0x1009ed80
0x1009ed87
0x1009ed8e
0x1009ed97
0x1009ed9f
0x1009eda1
0x1009eda3
0x1009edcd
0x1009edd3
0x1009edd6
0x1009edd8
0x1009ee39
0x1009ee39
0x1009ee40
0x1009ee43
0x1009ee48
0x1009ee50
0x1009ee56
0x1009ee59
0x1009ee5b
0x1009ee68
0x00000000
0x1009ee5d
0x1009ee5d
0x1009ee60
0x1009ee60
0x1009edda
0x1009edda
0x1009ede0
0x1009ede6
0x1009eded
0x1009edf0
0x1009edf4
0x1009edfa
0x1009edfd
0x1009ee00
0x1009ee0c
0x1009ee12
0x1009ee15
0x1009ee17
0x00000000
0x1009ee19
0x1009ee19
0x1009ee1c
0x1009ee1e
0x1009ee1f
0x1009ee20
0x1009ee21
0x1009ee22
0x1009ee22
0x1009ee17
0x1009edd8
0x1009ed74
0x00000000
0x1009ed1e
0x1009ee28
0x1009ee2b
0x1009ee2b
0x1009ee2d
0x1009ee2f
0x1009ee30
0x1009ee31
0x1009ee32
0x1009ee33
0x1009ec84
0x1009ec84
0x1009ec8e
0x1009ec91
0x1009ec96
0x1009ec98
0x1009ecea
0x1009ecea
0x1009eced
0x1009ecee
0x1009ecef
0x1009ecf0
0x1009ec9a
0x1009ec9a
0x1009ec9a
0x1009ec9d
0x1009ec9f
0x1009eca0
0x1009eca1
0x1009e8d0
0x1009e8d2
0x1009e8d4
0x1009e8d7
0x1009e8de
0x1009e8e3
0x1009e8ea
0x1009e988
0x00000000
0x1009e900
0x1009e900
0x1009e900
0x1009e902
0x1009e907
0x00000000
0x00000000
0x1009e90b
0x00000000
0x1009e90d
0x1009e90d
0x1009e90f
0x00000000
0x1009e911
0x1009e911
0x1009e911
0x1009e915
0x1009e933
0x1009e936
0x1009e93b
0x1009e93e
0x1009e940
0x1009e94f
0x1009e942
0x1009e942
0x1009e942
0x1009e945
0x1009e948
0x1009e948
0x1009e915
0x1009e90f
0x00000000
0x1009e90b
0x1009e960
0x1009e967
0x1009e96d
0x1009e971
0x1009e979
0x1009e97c
0x1009e97c
0x1009e917
0x1009e917
0x1009e928
0x1009e928
0x1009ec98
0x1009ec82
0x1009ec72
0x00000000

APIs

Part of subcall function 1009E5C0: calloc.MSVCRT ref: 1009E64E

TlsAlloc.KERNEL32(000003E8,?,?,100A014E,?,?,000003E8,000003E8,1009E449), ref: 1009EC74
fprintf.MSVCRT ref: 1009ECD9
abort.MSVCRT(?,100A014E,?,?,000003E8,000003E8,1009E449), ref: 1009ECF9
GetCurrentThreadId.KERNEL32 ref: 1009ED2B
CreateEventA.KERNEL32 ref: 1009ED53
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,?,00000000), ref: 1009ED95
GetCurrentThread.KERNEL32 ref: 1009ED99
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,?,00000000), ref: 1009EDA1
DuplicateHandle.KERNEL32 ref: 1009EDCD
GetThreadPriority.KERNEL32 ref: 1009EDE0
TlsSetValue.KERNEL32 ref: 1009EE0C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Current$Thread$Process$AllocCreateDuplicateEventHandlePriorityValueabortcallocfprintf
String ID:
API String ID: 3428539040-0
Opcode ID: e6f4fabb70a752b0f9d1ce73fe75a641f6247fdb0f994b193c8146088a05ef62
Instruction ID: 23075a1e2d58b6c06a6891da64cf4698154f98e006e9a0e55ce9434801cef3f5
Opcode Fuzzy Hash: e6f4fabb70a752b0f9d1ce73fe75a641f6247fdb0f994b193c8146088a05ef62
Instruction Fuzzy Hash: D95179B59053509FD700AF79D9C921ABBE4FB44350F414A6DE88887396E779C884CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001A460 Relevance: 19.6, APIs: 13, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E1001A460(signed char __eax) {
				void* __ebx;
				void* __esi;
				void* _t68;
				intOrPtr _t74;
				signed char _t79;
				signed char _t82;
				char* _t83;
				intOrPtr _t85;
				signed int _t86;
				signed int _t89;
				intOrPtr _t90;
				signed int _t92;
				signed int _t94;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr* _t100;

				_t79 = __eax;
				_t100 = _t99 - 0x1c;
				if( *((intOrPtr*)(__eax + 0xe4)) > 0) {
					_t89 = 0;
					do {
						_t98 =  *((intOrPtr*)(__eax + 0xe0)) + _t89 * 4;
						_t89 = _t89 + 1;
						_t95 =  *_t98;
						_t96 = _t95 + 0xc;
						 *_t100 = _t95 + 0x10;
						E1000A000(__eax, _t96);
						 *_t100 = _t96;
						E10011CC0();
						 *_t100 = _t98;
						E100265C0();
					} while (_t89 <  *((intOrPtr*)(_t79 + 0xe4)));
				}
				_t90 = _t79 + 0xb8;
				 *((intOrPtr*)(_t79 + 0xe4)) = 0;
				 *_t100 = _t79 + 0xe0;
				_t85 = _t79 + 0xd8;
				E100265C0();
				do {
					 *_t100 = _t90;
					_t90 = _t90 + 4;
					E1000A000(_t79, _t90);
				} while (_t85 != _t90);
				if( *((intOrPtr*)(_t79 + 0xdc)) > 0) {
					_t94 = 0;
					do {
						_t74 =  *((intOrPtr*)(_t79 + 0xd8)) + _t94 * 4;
						_t94 = _t94 + 1;
						 *_t100 = _t74;
						E1000A000(_t79, _t94);
					} while (_t94 <  *((intOrPtr*)(_t79 + 0xdc)));
				}
				 *_t100 = _t85;
				E100265C0();
				 *_t100 = _t79 + 0x118;
				E10011CC0();
				 *_t100 = _t79 + 0x128;
				E1000A000(_t79, _t90);
				 *_t100 = _t79 + 0x12c;
				E1000A000(_t79, _t90);
				 *_t100 = _t79 + 0x140;
				E1000A000(_t79, _t90);
				if( *(_t79 + 0x40) != _t79) {
					 *_t100 = _t79 + 0x40;
					E100265C0();
				}
				_t86 = 0x178;
				 *_t100 = _t79 + 0x158;
				E1000D270();
				_t82 = _t79;
				if((_t79 & 0x00000001) != 0) {
					 *_t79 = 0;
					_t82 = _t79 + 1;
					_t86 = 0x177;
					if((_t82 & 0x00000002) == 0) {
						goto L12;
					} else {
						goto L20;
					}
					L14:
					_t83 = _t82 + _t68;
					if((_t86 & 0x00000004) != 0) {
						 *_t83 = 0;
						_t83 = _t83 + 4;
					}
					if((_t86 & 0x00000002) != 0) {
						 *_t83 = 0;
						_t83 = _t83 + 2;
					}
					if((_t86 & 0x00000001) != 0) {
						 *_t83 = 0;
					}
					 *((intOrPtr*)(_t79 + 0x100)) = 0;
					 *((intOrPtr*)(_t79 + 0xf4)) = 2;
					 *((intOrPtr*)(_t79 + 0x70)) = 0;
					 *((intOrPtr*)(_t79 + 0x74)) = 0x80000000;
					 *((intOrPtr*)(_t79 + 0x68)) = 0;
					 *((intOrPtr*)(_t79 + 0x6c)) = 0x80000000;
					 *((intOrPtr*)(_t79 + 0x104)) = 0x80000000;
					 *((intOrPtr*)(_t79 + 0x108)) = 0xffffffff;
					 *((intOrPtr*)(_t79 + 0x10c)) = 0xffffffff;
					 *((intOrPtr*)(_t79 + 0x124)) = 0xffffffff;
					 *((intOrPtr*)(_t79 + 0x7c)) = 1;
					 *((intOrPtr*)(_t79 + 0x54)) = 1;
					 *((intOrPtr*)(_t79 + 0x60)) = 1;
					 *((intOrPtr*)(_t79 + 0x50)) = 0xffffffff;
					 *(_t79 + 0x40) = _t79;
					 *((intOrPtr*)(_t79 + 0xf0)) = 2;
					 *((intOrPtr*)(_t79 + 0xf8)) = 2;
					return 2;
				} else {
					if((_t82 & 0x00000002) != 0) {
						L20:
						 *_t82 = 0;
						_t86 = _t86 - 2;
						_t82 = _t82 + 2;
					}
				}
				L12:
				_t68 = 0;
				_t92 = _t86 & 0xfffffff8;
				do {
					 *((intOrPtr*)(_t82 + _t68)) = 0;
					 *((intOrPtr*)(_t82 + _t68 + 4)) = 0;
					_t68 = _t68 + 8;
				} while (_t68 < _t92);
				goto L14;
			}

0x1001a464
0x1001a466
0x1001a471
0x1001a473
0x1001a480
0x1001a486
0x1001a489
0x1001a48a
0x1001a490
0x1001a493
0x1001a496
0x1001a49b
0x1001a49e
0x1001a4a3
0x1001a4a6
0x1001a4ab
0x1001a480
0x1001a4b3
0x1001a4bb
0x1001a4c7
0x1001a4ca
0x1001a4d0
0x1001a4e0
0x1001a4e0
0x1001a4e3
0x1001a4e6
0x1001a4eb
0x1001a4f7
0x1001a4f9
0x1001a500
0x1001a506
0x1001a509
0x1001a50a
0x1001a50d
0x1001a512
0x1001a500
0x1001a51a
0x1001a51d
0x1001a528
0x1001a52b
0x1001a536
0x1001a539
0x1001a544
0x1001a547
0x1001a552
0x1001a555
0x1001a55d
0x1001a562
0x1001a565
0x1001a565
0x1001a570
0x1001a575
0x1001a578
0x1001a582
0x1001a584
0x1001a668
0x1001a66b
0x1001a66e
0x1001a676
0x00000000
0x00000000
0x00000000
0x00000000
0x1001a5a8
0x1001a5a8
0x1001a5b0
0x1001a6a5
0x1001a6ab
0x1001a6ab
0x1001a5bc
0x1001a698
0x1001a69d
0x1001a69d
0x1001a5c5
0x1001a690
0x1001a690
0x1001a5d2
0x1001a5e2
0x1001a5f2
0x1001a603
0x1001a60a
0x1001a611
0x1001a618
0x1001a61e
0x1001a624
0x1001a62a
0x1001a630
0x1001a637
0x1001a63e
0x1001a645
0x1001a64c
0x1001a64f
0x1001a655
0x1001a662
0x1001a58a
0x1001a58d
0x1001a680
0x1001a680
0x1001a685
0x1001a688
0x1001a688
0x1001a58d
0x1001a593
0x1001a595
0x1001a597
0x1001a59a
0x1001a59a
0x1001a59d
0x1001a5a1
0x1001a5a4
0x00000000

APIs

mv_dict_free.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A49E
mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4A6
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A496

Part of subcall function 1000A000: mv_freep.MAIN ref: 1000A01E

mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4D0
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4E6
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A50D
mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A51D
mv_dict_free.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A52B
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A539
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A547
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A555
mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A565
mv_channel_layout_uninit.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A578

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_unref$mv_freep$mv_dict_free$mv_channel_layout_uninit
String ID:
API String ID: 1735483532-0
Opcode ID: 945f5bc7cbde55a6aa345190f856de26ec9369814dab5ad9417d2f0141cb4add
Instruction ID: 3743f490041121a309f73bd17641a77e7b536aba58928b40e76834ce72ff9424
Opcode Fuzzy Hash: 945f5bc7cbde55a6aa345190f856de26ec9369814dab5ad9417d2f0141cb4add
Instruction Fuzzy Hash: 3A516CB19047028BDB10DF24C88178A77E5FF45364F0A45BADC989F38AE775E8C58BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000C640 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1000C650
memcmp.MSVCRT ref: 1000C6F4

Strings

mono, xrefs: 1000C6B0

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: memcmpstrlen
String ID: mono
API String ID: 3108337309-2381334079
Opcode ID: 05a9566f9cebdc7444aeb341508e8bd87ecfd7e1d953646c9f26566dae47a867
Instruction ID: b6009183c03875402946771f74e016b0be1646e1b5b10329ba9fdfd6138aa893
Opcode Fuzzy Hash: 05a9566f9cebdc7444aeb341508e8bd87ecfd7e1d953646c9f26566dae47a867
Instruction Fuzzy Hash: 4D712874A083598FE314DF25C484A1ABBE2FFC8384F15892EE88997315DB70E8459B86

Uniqueness

Uniqueness Score: -1.00%

Function 1001E450 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Strings

The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_pix_fmt_namemv_log
String ID: The hardware pixel format '%s' is not supported by the device type '%s'
API String ID: 3418758923-379977042
Opcode ID: 5dfad572c67db8fa61b7bb2c6cdad9a604c24d0b64868fd794a6f7046a9e5d28
Instruction ID: 93c42ac0cc7c39aee4c6308fb1e9594b2517373d7f7eca67d321c97bd06f55ee
Opcode Fuzzy Hash: 5dfad572c67db8fa61b7bb2c6cdad9a604c24d0b64868fd794a6f7046a9e5d28
Instruction Fuzzy Hash: 4861C274608B818FC750DF29C480A0EB7E5FF88754F568A6DE998DB351E770EC818B42

Uniqueness

Uniqueness Score: -1.00%

Function 1000A1D0 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

mv_realloc.MAIN ref: 1000A231
mv_mallocz.MAIN ref: 1000A24B
mv_mallocz.MAIN ref: 1000A284
mv_freep.MAIN ref: 1000A2DA
mv_realloc.MAIN ref: 1000A344
mv_realloc.MAIN ref: 1000A36B
mv_mallocz.MAIN ref: 1000A385
mv_mallocz.MAIN ref: 1000A3BC

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_realloc$mv_freep
String ID:
API String ID: 3944475926-0
Opcode ID: 21c0e84fb2d2b07cdbd2145871ab2905cba1277f35f8114cc737119d02b58269
Instruction ID: 4ee62d273146a1fe968e339e986c88b207b98d61c88eaf1789f61ff4cee38887
Opcode Fuzzy Hash: 21c0e84fb2d2b07cdbd2145871ab2905cba1277f35f8114cc737119d02b58269
Instruction Fuzzy Hash: BF7115B48087508FD710DF24C48471ABBE0FF8A384F568A6DE9898B369D775E980CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10029240 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 225stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 100292C3
mv_log.MAIN ref: 100292ED

Strings

%-15s , xrefs: 100292D4
%s%-17s , xrefs: 10029400
%-12s , xrefs: 10029440
%c%c%c%c%c%c%c%c%c%c%c, xrefs: 1002957E

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_logstrcmp
String ID: %-15s $ %s%-17s $%-12s $%c%c%c%c%c%c%c%c%c%c%c
API String ID: 3828882664-2158144587
Opcode ID: c48dc548631b7f659bb685c49b41025a06e9f8ff27b96d58c12b2f1b24194a37
Instruction ID: 3677ec4a8534b68b16c6bb5c66c61464159a9298d24f20388bbc5c890a847a5f
Opcode Fuzzy Hash: c48dc548631b7f659bb685c49b41025a06e9f8ff27b96d58c12b2f1b24194a37
Instruction Fuzzy Hash: 0F9128B5A197018FC714CF28D88065EBBE2EFC8754F55CA2EF89987395D378D8448B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004C151 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1004C2A7
mv_log.MAIN ref: 1004C320
mv_log.MAIN ref: 1004C3E1
mv_log.MAIN ref: 1004C413

Strings

Valid timecode frame rate must be specified. Minimum value is 1, xrefs: 1004C3FE
Drop frame is only allowed with multiples of 30000/1001 FPS, xrefs: 1004C30B
%d:%d:%d%c%d, xrefs: 1004C19B
gfff, xrefs: 1004C342
Unable to parse timecode, syntax: hh:mm:ss[:;.]ff, xrefs: 1004C3CA
Using non-standard frame rate %d/%d, xrefs: 1004C287

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: %d:%d:%d%c%d$Drop frame is only allowed with multiples of 30000/1001 FPS$Unable to parse timecode, syntax: hh:mm:ss[:;.]ff$Using non-standard frame rate %d/%d$Valid timecode frame rate must be specified. Minimum value is 1$gfff
API String ID: 2418673259-2042051344
Opcode ID: 376a6e0f90061a24e2ad68bb5ac7123712083f15859e3ba11df8d7ef79b39b28
Instruction ID: 2dccc3d4a2f57473898200d4d9d73c3d244c783664df16274e88938e09edcc61
Opcode Fuzzy Hash: 376a6e0f90061a24e2ad68bb5ac7123712083f15859e3ba11df8d7ef79b39b28
Instruction Fuzzy Hash: 7C6193719087498BC760CF68C580B4EBBE1FB84350F25893FE999DB351D674EE409B86

Uniqueness

Uniqueness Score: -1.00%

Function 1001DB70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

mv_frame_alloc.MAIN ref: 1001DC63
mv_frame_get_buffer.MAIN ref: 1001DC93
mv_hwframe_transfer_data.MAIN ref: 1001DCAF
mv_frame_move_ref.MAIN ref: 1001DCD3
mv_frame_free.MAIN ref: 1001DCE7
mv_log.MAIN ref: 1001DD57
mv_log.MAIN ref: 1001DD7B

Strings

A device with a derived frame context cannot be used as the destination of a HW -> HW transfer., xrefs: 1001DD69
A device with a derived frame context cannot be used as the source of a HW -> HW transfer., xrefs: 1001DD45

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_frame_allocmv_frame_freemv_frame_get_buffermv_frame_move_refmv_hwframe_transfer_data
String ID: A device with a derived frame context cannot be used as the destination of a HW -> HW transfer.$A device with a derived frame context cannot be used as the source of a HW -> HW transfer.
API String ID: 3503551841-3930429987
Opcode ID: 0ab2c88c998b68c1c31fcf51cfd8aa201dff7e06c6b4d5fb4ab622268dd49677
Instruction ID: b832bc673459a80082fa6857e5b55f2a154ec858a758ce949497184809a005a6
Opcode Fuzzy Hash: 0ab2c88c998b68c1c31fcf51cfd8aa201dff7e06c6b4d5fb4ab622268dd49677
Instruction Fuzzy Hash: EB6172B46087028FC354EF29C58051AFBF1FF88650F15C96EE9998B321E771E881DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001E2F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E1001E2F0(intOrPtr _a4, char _a8) {
				char _v16;
				intOrPtr _v32;
				intOrPtr _v48;
				char* _v52;
				char _v56;
				void* __ebx;
				void* __esi;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t42;
				intOrPtr _t45;
				char _t46;
				intOrPtr _t49;
				char _t58;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr _t70;
				intOrPtr _t71;
				void* _t72;
				intOrPtr* _t73;

				_t73 = _t72 - 0x34;
				_t37 = _a4;
				_t58 = _a8;
				_t71 =  *((intOrPtr*)(_t37 + 4));
				_t63 =  *((intOrPtr*)(_t71 + 4));
				_t61 =  *((intOrPtr*)(_t63 + 0xc));
				if( *((intOrPtr*)(_t63 + 0xc)) == 0) {
					_t64 =  *_t63;
					_t62 =  *((intOrPtr*)(_t64 + 0x3c));
					if( *((intOrPtr*)(_t64 + 0x3c)) == 0) {
						_t38 = 0xffffffd8;
						goto L7;
					} else {
						if( *((intOrPtr*)(_t71 + 0x1c)) == 0) {
							_t38 = 0xffffffea;
							goto L7;
						} else {
							 *_t73 = _t37;
							_t39 = L10009FC0(_t58, _t62);
							 *((intOrPtr*)(_t58 + 0x128)) = _t39;
							if(_t39 == 0) {
								goto L6;
							} else {
								_v56 = _t58;
								 *_t73 = _t71;
								_t42 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t71 + 4)))) + 0x3c))();
								if(_t42 < 0) {
									_v32 = _t42;
									 *_t73 = _t58 + 0x128;
									E1000A000(_t58 + 0x128, _t71);
									_t38 = _v32;
									goto L7;
								} else {
									 *((intOrPtr*)(_t58 + 0x40)) = _t58;
									return 0;
								}
							}
						}
					}
				} else {
					 *((intOrPtr*)(_t58 + 0x50)) =  *((intOrPtr*)(_t71 + 0x24));
					 *_t73 = _t37;
					_t45 = L10009FC0(_t58, _t61);
					 *((intOrPtr*)(_t58 + 0x128)) = _t45;
					if(_t45 == 0) {
						L6:
						_t38 = 0xfffffff4;
						goto L7;
					} else {
						_t46 = E1001AC40(_t58, _t70, _t71);
						_v16 = _t46;
						if(_t46 == 0) {
							goto L6;
						} else {
							_v56 = _t46;
							_v52 = 0;
							 *_t73 =  *((intOrPtr*)( *((intOrPtr*)(_t71 + 4)) + 0xc));
							_t49 = E1001E2F0();
							if(_t49 < 0) {
								L13:
								_v32 = _t49;
								 *_t73 =  &_v16;
								L1001ADB0(_t58);
								return _v32;
							} else {
								 *_t73 = _t58;
								_v52 =  *((intOrPtr*)( *((intOrPtr*)(_t71 + 4)) + 0x10));
								_v56 = _v16;
								_t49 = E1001E0B0(_t58, _t70, _t71);
								if(_t49 == 0) {
									goto L13;
								} else {
									_v48 = _t49;
									_v32 = _t49;
									_v56 = 0x10;
									_v52 = "Failed to map frame into derived frame context: %d.\n";
									 *_t73 = _t71;
									E10023A40();
									 *_t73 =  &_v16;
									L1001ADB0("Failed to map frame into derived frame context: %d.\n");
									_t38 = _v32;
									L7:
									return _t38;
								}
							}
						}
					}
				}
			}

0x1001e2f2
0x1001e2f5
0x1001e2f9
0x1001e2fd
0x1001e300
0x1001e303
0x1001e308
0x1001e3c0
0x1001e3c2
0x1001e3c7
0x1001e445
0x00000000
0x1001e3c9
0x1001e3ce
0x1001e43b
0x00000000
0x1001e3d0
0x1001e3d0
0x1001e3d3
0x1001e3d8
0x1001e3e0
0x00000000
0x1001e3e2
0x1001e3e7
0x1001e3eb
0x1001e3ee
0x1001e3f3
0x1001e420
0x1001e42a
0x1001e42d
0x1001e432
0x00000000
0x1001e3f5
0x1001e3f5
0x1001e3ff
0x1001e3ff
0x1001e3f3
0x1001e3e0
0x1001e3ce
0x1001e30e
0x1001e311
0x1001e314
0x1001e317
0x1001e31c
0x1001e324
0x1001e3b0
0x1001e3b0
0x00000000
0x1001e32a
0x1001e32a
0x1001e32f
0x1001e335
0x00000000
0x1001e337
0x1001e337
0x1001e33d
0x1001e347
0x1001e34a
0x1001e351
0x1001e400
0x1001e400
0x1001e408
0x1001e40b
0x1001e419
0x1001e357
0x1001e35d
0x1001e360
0x1001e368
0x1001e36c
0x1001e373
0x00000000
0x1001e379
0x1001e379
0x1001e382
0x1001e38b
0x1001e38f
0x1001e393
0x1001e396
0x1001e39f
0x1001e3a2
0x1001e3a7
0x1001e3b5
0x1001e3ba
0x1001e3ba
0x1001e373
0x1001e351
0x1001e335
0x1001e324

APIs

mv_frame_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E32A

Part of subcall function 1001AC40: mv_malloc.MAIN ref: 1001AC56

mv_hwframe_get_buffer.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E34A

Part of subcall function 1001E2F0: mv_hwframe_map.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E36C
Part of subcall function 1001E2F0: mv_log.MAIN ref: 1001E396
Part of subcall function 1001E2F0: mv_frame_free.MAIN ref: 1001E3A2

mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E317

Part of subcall function 10009FC0: mv_mallocz.MAIN ref: 10009FD2

mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E3D3

Strings

Failed to map frame into derived frame context: %d., xrefs: 1001E37D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_ref$mv_frame_allocmv_frame_freemv_hwframe_get_buffermv_hwframe_mapmv_logmv_mallocmv_mallocz
String ID: Failed to map frame into derived frame context: %d.
API String ID: 2770197599-2491951210
Opcode ID: b982bc6816b3afb20851306c66ddb92193a8adb26d1f7859c5dff6e59dc61fb9
Instruction ID: 9b451d42297ff9da348d1ac60a3a70938ed94ec3f991f54ec8aa55de9da18352
Opcode Fuzzy Hash: b982bc6816b3afb20851306c66ddb92193a8adb26d1f7859c5dff6e59dc61fb9
Instruction Fuzzy Hash: 0041F5B46087418FD740DF29D48055FBBE0FF88350F05892DE9A98B345EB34E9818F82

Uniqueness

Uniqueness Score: -1.00%

Function 100A2C80 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 100A2CB2
CreateSemaphoreA.KERNEL32 ref: 100A2D08
CreateSemaphoreA.KERNEL32 ref: 100A2D2F
InitializeCriticalSection.KERNEL32 ref: 100A2D4E
InitializeCriticalSection.KERNEL32 ref: 100A2D59
InitializeCriticalSection.KERNEL32 ref: 100A2D64

Strings

l, xrefs: 100A2CA3

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: d73fa1ff119fedf16ac3b193d312d69093a5ec08c58096642c76372833d18162
Instruction ID: 38c73280bd5015997ddb94b8f3b1a0e3b7c18065f3be8c9e97bba9cb39e7b6f3
Opcode Fuzzy Hash: d73fa1ff119fedf16ac3b193d312d69093a5ec08c58096642c76372833d18162
Instruction Fuzzy Hash: 80310AB1505310CFE750BF6CD98875ABBE4FF40354F12896DD8948B29AE779D444CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1002E7A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002E7B8
strcmp.MSVCRT ref: 1002E7D0
strcmp.MSVCRT ref: 1002E7E8
strcmp.MSVCRT ref: 1002E800
strcmp.MSVCRT ref: 1002E818
strcmp.MSVCRT ref: 1002E830
strcmp.MSVCRT ref: 1002E848
strcmp.MSVCRT ref: 1002E860
mv_parse_ratio.MAIN(?,?,?,?,?,?,?,?,1002BD7B), ref: 1002E88C

Part of subcall function 1002E5D0: mv_expr_parse_and_eval.MAIN ref: 1002E659
Part of subcall function 1002E5D0: mv_d2q.MAIN ref: 1002E675

Strings

ntsc, xrefs: 1002E7A5

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_d2qmv_expr_parse_and_evalmv_parse_ratio
String ID: ntsc
API String ID: 2874497773-2045543799
Opcode ID: 83ae849ea13b95b91902b7d20c8a5323a228a97e6b021accf889ee30e99a21e1
Instruction ID: f84328928982e3785df4aaf20589b6ac80a434cb6b10c7022aa99fc1399d0474
Opcode Fuzzy Hash: 83ae849ea13b95b91902b7d20c8a5323a228a97e6b021accf889ee30e99a21e1
Instruction Fuzzy Hash: 9031FBB89893819AD750EF29A54161BB6E4EF44380F968C2EA9CCC7340DF74DD40EB53

Uniqueness

Uniqueness Score: -1.00%

Function 100099E1 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100099E1(void* __eax, void* __ebx, void* __edx, void* __esi, signed int _a4, char* _a8) {
				void* _t23;

				_t23 = __eax;
				__eflags = __edx;
				if(__edx == 0) {
					do {
						__eflags = __al - 0x3c;
						if(__eflags == 0) {
							 *__esp = __esi;
							__eax = 0x100ac50e;
							__edx = 0x100ac500;
							_a8 = 0x100ac50e;
							_a4 = 0x100ac500;
							__eax = E100089C0();
						} else {
							if(__eflags <= 0) {
								__eflags = __al - 0x26;
								if(__al == 0x26) {
									 *__esp = __esi;
									__eax = 0x100ac508;
									_a8 = 0x100ac508;
									__eax = 0x100ac500;
									_a4 = 0x100ac500;
									__eax = E100089C0();
								} else {
									__eflags = __al - 0x27;
									if(__al != 0x27) {
										goto L22;
									} else {
										 *__esp = __esi;
										__eax = 0x100ac500;
										_a8 = "&apos;";
										_a4 = 0x100ac500;
										__eax = E100089C0();
									}
								}
							} else {
								__eflags = __al - 0x3e;
								if(__al != 0x3e) {
									L22:
									__edx = __al;
									__esi = E100086F0(__esi, __al);
								} else {
									 *__esp = __esi;
									_a8 = 0x100ac513;
									_a4 = 0x100ac500;
									__eax = E100089C0();
								}
							}
						}
						__eax =  *(__ebx + 1) & 0x000000ff;
						__ebx = __ebx + 1;
						__eflags = __al;
					} while (__al != 0);
				} else {
					do {
						__dl = __al;
						__dl = __al - 0x22;
						__eflags = __dl - 0x1c;
						if(__dl > 0x1c) {
							L14:
							__edx = __al;
							__esi = E100086F0(__esi, __al);
						} else {
							__edx = __dl & 0x000000ff;
							switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M100AC530))) {
								case 0:
									 *__esp = __esi;
									__eax = "&quot;";
									_a8 = "&quot;";
									__eax = 0x100ac500;
									_a4 = 0x100ac500;
									__eax = E100089C0();
									goto L15;
								case 1:
									goto L14;
								case 2:
									 *__esp = __esi;
									__eax = 0x100ac508;
									_a8 = 0x100ac508;
									__eax = 0x100ac500;
									_a4 = 0x100ac500;
									__eax = E100089C0();
									goto L15;
								case 3:
									 *__esp = __esi;
									__eax = "&apos;";
									_a8 = "&apos;";
									__eax = 0x100ac500;
									_a4 = 0x100ac500;
									__eax = E100089C0();
									goto L15;
								case 4:
									 *__esp = __esi;
									_a8 = 0x100ac50e;
									_a4 = 0x100ac500;
									__eax = E100089C0();
									goto L15;
								case 5:
									 *__esp = __esi;
									__edx = 0x100ac513;
									_a8 = 0x100ac513;
									_a4 = 0x100ac500;
									__eax = E100089C0();
									goto L15;
							}
						}
						L15:
						__eax =  *(__ebx + 1) & 0x000000ff;
						__ebx = __ebx + 1;
						__eflags = __al;
					} while (__al != 0);
				}
				return _t23;
			}

0x100099e1
0x100099e8
0x100099ea
0x10009a4d
0x10009a4d
0x10009a4f
0x10009c10
0x10009c13
0x10009c18
0x10009c1d
0x10009c21
0x10009c25
0x10009a55
0x10009a55
0x10009a10
0x10009a12
0x10009c30
0x10009c33
0x10009c38
0x10009c3c
0x10009c41
0x10009c45
0x10009a18
0x10009a18
0x10009a1a
0x00000000
0x10009a20
0x10009a20
0x10009a28
0x10009a2d
0x10009a31
0x10009a35
0x10009a35
0x10009a1a
0x10009a57
0x10009a57
0x10009a60
0x10009b90
0x10009b90
0x10009b95
0x10009a66
0x10009a66
0x10009a73
0x10009a77
0x10009a7b
0x10009a7b
0x10009a60
0x10009a55
0x10009a40
0x10009a44
0x10009a45
0x10009a45
0x100099f0
0x100099f0
0x100099f0
0x100099f2
0x100099f5
0x100099f8
0x10009a88
0x10009a88
0x10009a8d
0x100099fe
0x100099fe
0x10009a01
0x00000000
0x10009b17
0x10009b1a
0x10009b1f
0x10009b23
0x10009b28
0x10009b2c
0x00000000
0x00000000
0x00000000
0x00000000
0x10009aa4
0x10009aa7
0x10009aac
0x10009ab0
0x10009ab5
0x10009ab9
0x00000000
0x00000000
0x10009af8
0x10009afb
0x10009b00
0x10009b04
0x10009b09
0x10009b0d
0x00000000
0x00000000
0x10009adc
0x10009ae9
0x10009aed
0x10009af1
0x00000000
0x00000000
0x10009ac0
0x10009ac3
0x10009acd
0x10009ad1
0x10009ad5
0x00000000
0x00000000
0x10009a01
0x10009a92
0x10009a92
0x10009a96
0x10009a97
0x10009a97
0x10009a9f
0x10009869

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A7B
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AB9
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AD5
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AF1
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009B0D
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009B2C

Strings

', xrefs: 10009AFB
>, xrefs: 10009AC3
<, xrefs: 10009ADF
&, xrefs: 10009AA7
", xrefs: 10009B1A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: &$'$>$<$"
API String ID: 3083893021-87953025
Opcode ID: a8492cc7d52c020423f32362092ccefd240c7d2216d999baf81aeaf4ef70062f
Instruction ID: 14f95469a8fd426adbc8d3b99f13887d58f0213caa7dd6ac72794508adc3bfbb
Opcode Fuzzy Hash: a8492cc7d52c020423f32362092ccefd240c7d2216d999baf81aeaf4ef70062f
Instruction Fuzzy Hash: BF110D70A08B55DEE710EF69808065EBBD1FB81680F56C81EF5D9CB245E639E9809783

Uniqueness

Uniqueness Score: -1.00%

Function 1001BC40 Relevance: 16.8, APIs: 11, Instructions: 283
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E1001BC40() {
				void* __ebx;
				signed int _t113;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t123;
				void* _t124;
				void* _t125;
				signed int _t127;
				void* _t128;
				void* _t129;
				signed char _t133;
				signed int _t134;
				signed int _t135;
				signed int _t139;
				intOrPtr _t141;
				intOrPtr _t146;
				signed int _t147;
				signed int _t148;
				signed int _t149;
				signed int _t154;
				signed int _t156;
				signed int _t158;
				signed int _t159;
				signed short* _t161;
				signed short* _t162;
				int _t166;
				signed char _t174;
				short* _t175;
				signed char _t176;
				short* _t177;
				signed int _t178;
				signed int _t180;
				signed int _t181;
				signed int _t182;
				signed int _t184;
				signed int _t186;
				void* _t187;
				void* _t190;
				signed int _t195;
				signed int _t196;
				signed int _t199;
				signed short* _t200;
				signed short* _t201;
				signed int _t202;
				void* _t203;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				void* _t209;
				signed int* _t210;

				_t210 = _t209 - 0x1c;
				_t154 = _t210[0xd];
				_t207 = _t210[0xc];
				_t181 = _t154 + 0x158;
				 *((intOrPtr*)(_t207 + 0x50)) =  *((intOrPtr*)(_t154 + 0x50));
				 *((intOrPtr*)(_t207 + 0x44)) =  *((intOrPtr*)(_t154 + 0x44));
				 *((intOrPtr*)(_t207 + 0x48)) =  *((intOrPtr*)(_t154 + 0x48));
				 *((intOrPtr*)(_t207 + 0x4c)) =  *((intOrPtr*)(_t154 + 0x4c));
				 *(_t207 + 0x120) =  *(_t154 + 0x120);
				 *(_t207 + 0xb4) =  *(_t154 + 0xb4);
				 *(_t207 + 0xb0) =  *(_t154 + 0xb0);
				 *_t210 = _t181;
				if(E1000EC10() == 0) {
					_t149 =  *(_t154 + 0xb4);
					_t180 =  *(_t154 + 0xb0);
					if((_t149 | _t180) != 0) {
						_t210[2] = _t149;
						_t210[1] = _t180;
						 *_t210 = _t207 + 0x158;
						E1000D1B0();
					} else {
						 *(_t207 + 0x15c) =  *(_t154 + 0x120);
						 *(_t207 + 0x158) = 0;
					}
				}
				_t160 = 0;
				_t113 = E1001A6C0(_t207, 0, _t154, 0);
				_t195 = _t113;
				if(_t113 < 0) {
					L19:
					E1001A460(_t207);
					return _t195;
				} else {
					 *_t210 = _t181;
					if(E1000EC10() != 0) {
						_t210[1] = _t181;
						 *_t210 = _t207 + 0x158;
						_t119 = E1000D340();
						__eflags = _t119;
						_t195 = _t119;
						if(_t119 < 0) {
							goto L19;
						} else {
							_t120 =  *(_t154 + 0xb8);
							__eflags = _t120;
							if(_t120 != 0) {
								goto L6;
							} else {
								goto L32;
							}
						}
					} else {
						_t120 =  *(_t154 + 0xb8);
						if(_t120 == 0) {
							L32:
							 *_t210 = _t207;
							_t210[1] = 0;
							_t147 = L1001ADF0();
							__eflags = _t147;
							_t195 = _t147;
							if(_t147 < 0) {
								goto L19;
							} else {
								_t210[1] = _t154;
								 *_t210 = _t207;
								_t148 = E1001B8D0();
								__eflags = _t148;
								_t195 = _t148;
								if(_t148 < 0) {
									goto L19;
								} else {
									goto L34;
								}
							}
						} else {
							L6:
							_t196 = 0;
							L8:
							while(1) {
								if(_t120 == 0) {
									L10:
									_t196 = _t196 + 1;
									if(_t196 != 8) {
										_t120 =  *(_t154 + 0xb8 + _t196 * 4);
										continue;
									} else {
										if( *((intOrPtr*)(_t154 + 0xd8)) == 0) {
											L21:
											_t121 =  *(_t154 + 0x128);
											__eflags = _t121;
											if(_t121 == 0) {
												L23:
												__eflags =  *(_t154 + 0x40) - _t154;
												if( *(_t154 + 0x40) == _t154) {
													 *(_t207 + 0x40) = _t207;
													goto L37;
												} else {
													_t186 =  *(_t207 + 0x15c);
													_t195 = 0xffffffea;
													__eflags = _t186;
													if(_t186 == 0) {
														goto L19;
													} else {
														_t210[1] = _t186;
														 *_t210 = 4;
														_t133 = E100263A0();
														 *(_t207 + 0x40) = _t133;
														__eflags = _t133;
														if(_t133 == 0) {
															goto L18;
														} else {
															_t166 = _t186 * 4;
															_t203 =  *(_t154 + 0x40);
															_t187 = _t133;
															__eflags = _t166 - 8;
															if(_t166 >= 8) {
																__eflags = _t133 & 0x00000001;
																if((_t133 & 0x00000001) != 0) {
																	_t134 =  *_t203 & 0x000000ff;
																	_t187 = _t187 + 1;
																	_t203 = _t203 + 1;
																	_t166 = _t166 - 1;
																	 *(_t187 - 1) = _t134;
																}
																__eflags = _t187 & 0x00000002;
																if((_t187 & 0x00000002) != 0) {
																	_t135 =  *_t203 & 0x0000ffff;
																	_t187 = _t187 + 2;
																	_t203 = _t203 + 2;
																	_t166 = _t166 - 2;
																	 *(_t187 - 2) = _t135;
																}
																__eflags = _t187 & 0x00000004;
																if((_t187 & 0x00000004) == 0) {
																	goto L27;
																} else {
																	_t190 = _t187 + 4;
																	 *(_t190 - 4) =  *_t203;
																	memcpy(_t190, _t203 + 4, _t166 - 4);
																	_t210 =  &(_t210[3]);
																	goto L37;
																}
																L49:
																_t177 = _t176 + _t128;
																_t201 = _t200 + _t128;
																_t129 = 0;
																__eflags = _t184 & 0x00000002;
																if((_t184 & 0x00000002) != 0) {
																	 *_t177 =  *_t201 & 0x0000ffff;
																	_t129 = 2;
																}
																__eflags = _t184 & 0x00000001;
																if((_t184 & 0x00000001) == 0) {
																	L34:
																	_t202 = 0;
																	__eflags = 0;
																} else {
																	_t202 = 0;
																	 *((char*)(_t177 + _t129)) =  *(_t201 + _t129) & 0x000000ff;
																}
																return _t202;
																goto L63;
															} else {
																L27:
																memcpy(_t187, _t203, _t166);
																_t210 =  &(_t210[3]);
															}
															L37:
															__eflags = _t207 & 0x00000001;
															_t174 = _t207;
															_t161 = _t154;
															_t182 = 0x20;
															if((_t207 & 0x00000001) != 0) {
																_t174 = _t207 + 1;
																_t182 = 0x1f;
																_t161 = _t154 + 1;
																 *_t207 =  *_t154 & 0x000000ff;
															}
															__eflags = _t174 & 0x00000002;
															if((_t174 & 0x00000002) != 0) {
																_t123 =  *_t161 & 0x0000ffff;
																_t174 = _t174 + 2;
																_t161 =  &(_t161[1]);
																_t182 = _t182 - 2;
																 *(_t174 - 2) = _t123;
															}
															_t210[0xd] = _t154;
															_t124 = 0;
															_t199 = _t182 & 0xfffffffc;
															__eflags = _t199;
															do {
																 *(_t174 + _t124) =  *(_t161 + _t124);
																_t124 = _t124 + 4;
																__eflags = _t124 - _t199;
															} while (_t124 < _t199);
															_t175 = _t174 + _t124;
															_t162 = _t161 + _t124;
															_t156 = _t210[0xd];
															_t125 = 0;
															__eflags = _t182 & 0x00000002;
															if((_t182 & 0x00000002) != 0) {
																 *_t175 =  *_t162 & 0x0000ffff;
																_t125 = 2;
															}
															__eflags = _t182 & 0x00000001;
															if((_t182 & 0x00000001) != 0) {
																 *((char*)(_t175 + _t125)) =  *(_t162 + _t125) & 0x000000ff;
															}
															__eflags = _t207 & 0x00000001;
															_t184 = 0x20;
															_t176 = _t207 + 0x20;
															_t200 = _t156 + 0x20;
															if((_t207 & 0x00000001) != 0) {
																_t176 = _t207 + 0x21;
																_t184 = 0x1f;
																_t200 = _t156 + 0x21;
																 *(_t207 + 0x20) =  *(_t156 + 0x20) & 0x000000ff;
															}
															__eflags = _t176 & 0x00000002;
															if((_t176 & 0x00000002) != 0) {
																_t127 =  *_t200 & 0x0000ffff;
																_t176 = _t176 + 2;
																_t200 =  &(_t200[1]);
																_t184 = _t184 - 2;
																 *(_t176 - 2) = _t127;
															}
															_t128 = 0;
															_t158 = _t184 & 0xfffffffc;
															__eflags = _t158;
															do {
																 *(_t176 + _t128) =  *(_t200 + _t128);
																_t128 = _t128 + 4;
																__eflags = _t128 - _t158;
															} while (_t128 < _t158);
															goto L49;
														}
													}
												}
											} else {
												 *_t210 = _t121;
												_t139 = L10009FC0(_t154, _t160);
												 *(_t207 + 0x128) = _t139;
												__eflags = _t139;
												if(_t139 == 0) {
													goto L18;
												} else {
													goto L23;
												}
											}
										} else {
											_t160 = 4;
											_t210[1] = 4;
											 *_t210 =  *(_t154 + 0xdc);
											_t141 = E100266D0();
											 *((intOrPtr*)(_t207 + 0xd8)) = _t141;
											if(_t141 == 0) {
												goto L18;
											} else {
												_t178 =  *(_t154 + 0xdc);
												 *(_t207 + 0xdc) = _t178;
												if(_t178 <= 0) {
													goto L21;
												} else {
													_t210[0xc] = _t207;
													_t208 = _t154;
													_t159 = 0;
													while(1) {
														_t206 = _t159 * 4;
														 *_t210 =  *( *((intOrPtr*)(_t208 + 0xd8)) + _t206);
														 *((intOrPtr*)(_t141 + _t206)) = L10009FC0(_t159, _t160);
														_t141 =  *((intOrPtr*)(_t210[0xc] + 0xd8));
														if( *((intOrPtr*)(_t141 + _t206)) == 0) {
															break;
														}
														_t159 = _t159 + 1;
														__eflags =  *((intOrPtr*)(_t208 + 0xdc)) - _t159;
														if( *((intOrPtr*)(_t208 + 0xdc)) <= _t159) {
															_t154 = _t208;
															_t207 = _t210[0xc];
															goto L21;
														} else {
															continue;
														}
														goto L63;
													}
													_t207 = _t210[0xc];
													goto L18;
												}
											}
										}
									}
								} else {
									 *_t210 = _t120;
									_t146 = L10009FC0(_t154, _t160);
									 *((intOrPtr*)(_t207 + 0xb8 + _t196 * 4)) = _t146;
									if(_t146 == 0) {
										L18:
										_t195 = 0xfffffff4;
										goto L19;
									} else {
										goto L10;
									}
								}
								goto L63;
							}
						}
					}
				}
				L63:
			}

0x1001bc44
0x1001bc47
0x1001bc4b
0x1001bc52
0x1001bc5e
0x1001bc64
0x1001bc6a
0x1001bc70
0x1001bc79
0x1001bc85
0x1001bc8b
0x1001bc91
0x1001bc9b
0x1001bc9d
0x1001bca3
0x1001bcad
0x1001be70
0x1001be7a
0x1001be7e
0x1001be81
0x1001bcb3
0x1001bcb9
0x1001bcc1
0x1001bcc1
0x1001bcad
0x1001bcc7
0x1001bccd
0x1001bcd4
0x1001bcd6
0x1001bdb8
0x1001bdba
0x1001bdc8
0x1001bcdc
0x1001bcdc
0x1001bce6
0x1001be40
0x1001be4a
0x1001be4d
0x1001be52
0x1001be54
0x1001be56
0x00000000
0x1001be5c
0x1001be5c
0x1001be62
0x1001be64
0x00000000
0x1001be6a
0x00000000
0x1001be6a
0x1001be64
0x1001bcec
0x1001bcec
0x1001bcf4
0x1001be90
0x1001be90
0x1001be95
0x1001be99
0x1001be9e
0x1001bea0
0x1001bea2
0x00000000
0x1001bea8
0x1001bea8
0x1001beac
0x1001beaf
0x1001beb4
0x1001beb6
0x1001beb8
0x00000000
0x00000000
0x00000000
0x00000000
0x1001beb8
0x1001bcfa
0x1001bcfa
0x1001bcfa
0x00000000
0x1001bd07
0x1001bd09
0x1001bd22
0x1001bd22
0x1001bd26
0x1001bd00
0x00000000
0x1001bd28
0x1001bd30
0x1001bdd6
0x1001bdd6
0x1001bddc
0x1001bdde
0x1001bdf2
0x1001bdf2
0x1001bdf5
0x1001bed0
0x00000000
0x1001bdfb
0x1001bdfb
0x1001be01
0x1001be06
0x1001be08
0x00000000
0x1001be0a
0x1001be0a
0x1001be0e
0x1001be15
0x1001be1a
0x1001be1d
0x1001be1f
0x00000000
0x1001be21
0x1001be21
0x1001be28
0x1001be2b
0x1001be2d
0x1001be30
0x1001bf96
0x1001bf98
0x1001c033
0x1001c036
0x1001c037
0x1001c038
0x1001c039
0x1001c039
0x1001bf9e
0x1001bfa4
0x1001c01e
0x1001c021
0x1001c024
0x1001c027
0x1001c02a
0x1001c02a
0x1001bfa6
0x1001bfac
0x00000000
0x1001bfb2
0x1001bfb4
0x1001bfbd
0x1001bfc0
0x1001bfc0
0x00000000
0x1001bfc0
0x1001bf66
0x1001bf66
0x1001bf68
0x1001bf6a
0x1001bf6c
0x1001bf72
0x1001bf77
0x1001bf7a
0x1001bf7a
0x1001bf7f
0x1001bf82
0x1001bebe
0x1001bebe
0x1001bebe
0x1001bf88
0x1001bf8c
0x1001bf8e
0x1001bf8e
0x1001bec9
0x00000000
0x1001be36
0x1001be36
0x1001be36
0x1001be36
0x1001be36
0x1001bed3
0x1001bed3
0x1001bed9
0x1001bedb
0x1001bedd
0x1001bee2
0x1001bfdf
0x1001bfe2
0x1001bfe7
0x1001bfea
0x1001bfea
0x1001bee8
0x1001beeb
0x1001bfc7
0x1001bfca
0x1001bfcd
0x1001bfd0
0x1001bfd3
0x1001bfd3
0x1001bef1
0x1001bef7
0x1001bef9
0x1001bef9
0x1001befc
0x1001beff
0x1001bf02
0x1001bf05
0x1001bf05
0x1001bf09
0x1001bf0b
0x1001bf0d
0x1001bf11
0x1001bf13
0x1001bf19
0x1001bf1e
0x1001bf21
0x1001bf21
0x1001bf26
0x1001bf29
0x1001bf2f
0x1001bf2f
0x1001bf32
0x1001bf38
0x1001bf3d
0x1001bf40
0x1001bf43
0x1001c00b
0x1001c00e
0x1001c013
0x1001c016
0x1001c016
0x1001bf49
0x1001bf4c
0x1001bff2
0x1001bff5
0x1001bff8
0x1001bffb
0x1001bffe
0x1001bffe
0x1001bf54
0x1001bf56
0x1001bf56
0x1001bf59
0x1001bf5c
0x1001bf5f
0x1001bf62
0x1001bf62
0x00000000
0x1001bf59
0x1001be1f
0x1001be08
0x1001bde0
0x1001bde0
0x1001bde3
0x1001bde8
0x1001bdee
0x1001bdf0
0x00000000
0x00000000
0x00000000
0x00000000
0x1001bdf0
0x1001bd36
0x1001bd36
0x1001bd3b
0x1001bd45
0x1001bd48
0x1001bd4d
0x1001bd55
0x00000000
0x1001bd57
0x1001bd57
0x1001bd5d
0x1001bd65
0x00000000
0x1001bd67
0x1001bd67
0x1001bd6d
0x1001bd6f
0x1001bd81
0x1001bd81
0x1001bd94
0x1001bd9c
0x1001bda2
0x1001bdad
0x00000000
0x00000000
0x1001bd78
0x1001bd79
0x1001bd7f
0x1001bdd0
0x1001bdd2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1001bd7f
0x1001bdaf
0x00000000
0x1001bdaf
0x1001bd65
0x1001bd55
0x1001bd30
0x1001bd0b
0x1001bd0b
0x1001bd0e
0x1001bd13
0x1001bd1c
0x1001bdb3
0x1001bdb3
0x00000000
0x00000000
0x00000000
0x00000000
0x1001bd1c
0x00000000
0x1001bd09
0x1001bd07
0x1001bcf4
0x1001bce6
0x00000000

APIs

mv_channel_layout_check.MAIN ref: 1001BC94
mv_channel_layout_check.MAIN ref: 1001BCDF
mv_buffer_ref.MAIN ref: 1001BD0E
mv_calloc.MAIN ref: 1001BD48
mv_buffer_ref.MAIN ref: 1001BD97
mv_channel_layout_from_mask.MAIN ref: 1001BE81

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_refmv_channel_layout_check$mv_callocmv_channel_layout_from_mask
String ID:
API String ID: 217990561-0
Opcode ID: e271b54056b9f311492b371745ecacf088e89dd9a8b481484f3ce772a1f2a20f
Instruction ID: 7e1a2b3b8c18e3e8a2997b8c95fa29518afe51d56a71e7d8b1f39b1cf0f03159
Opcode Fuzzy Hash: e271b54056b9f311492b371745ecacf088e89dd9a8b481484f3ce772a1f2a20f
Instruction Fuzzy Hash: F9B17A75A04B958BCB60CF28C8817AA7BE1EF89350F164579ED88CF346E734D881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1004C90C Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: a695cc76ce69234c581bf4b4b735b6e1a38d1706809023f07848c68a58c7e2d7
Instruction ID: d5bf940e379ca4a6bd7046eb797087e303209b84da27322be6da1c3234df6ef9
Opcode Fuzzy Hash: a695cc76ce69234c581bf4b4b735b6e1a38d1706809023f07848c68a58c7e2d7
Instruction Fuzzy Hash: D3A1C3B490974A9FC340DF6AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1000A720 Relevance: 16.7, APIs: 11, Instructions: 173COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1000A72E
mv_mallocz.MAIN ref: 1000A7D5
ReleaseSRWLockExclusive.KERNEL32 ref: 1000A808
mv_mallocz.MAIN ref: 1000A890
ReleaseSRWLockExclusive.KERNEL32 ref: 1000A8C4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$Releasemv_mallocz$Acquire
String ID:
API String ID: 2881747546-0
Opcode ID: 0d1f996a099190dbcac24ef498fb0996fadf9c399d392a80c4173242cb49765f
Instruction ID: e8e0c9d1389fe9fc4d2fa8f13575414dd6078b243068f84da3cacd96059e79d8
Opcode Fuzzy Hash: 0d1f996a099190dbcac24ef498fb0996fadf9c399d392a80c4173242cb49765f
Instruction Fuzzy Hash: B36138B49087018FE714DF25C48170BBBE1EF85380F12866DE8998B35ADB74E981CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001CBC0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON

Download Yara Rule

APIs

mv_sha512_final.MAIN ref: 1001CC05
mv_ripemd_final.MAIN ref: 1001CC4D
mv_sha_final.MAIN ref: 1001CCAD
mv_md5_final.MAIN ref: 1001CCFD
mv_murmur3_final.MAIN ref: 1001CD1D
mv_sha512_final.MAIN ref: 1001CEE5
mv_base64_encode.MAIN ref: 1001CF08
mv_ripemd_final.MAIN ref: 1001CF6D
mv_sha_final.MAIN ref: 1001CF8D
mv_md5_final.MAIN ref: 1001CFAD
mv_murmur3_final.MAIN ref: 1001CFCD

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_md5_finalmv_murmur3_finalmv_ripemd_finalmv_sha512_finalmv_sha_final$mv_base64_encode
String ID:
API String ID: 2245914800-0
Opcode ID: cbf8682a6949939ebfa53a5087d5bc86ec31282e764cd6197cb9dae495c33194
Instruction ID: 66ec89d01881a44b036f877079f41eaa8749121b6e2b330ab673921147de27d8
Opcode Fuzzy Hash: cbf8682a6949939ebfa53a5087d5bc86ec31282e764cd6197cb9dae495c33194
Instruction Fuzzy Hash: 4B6105B5909755CFD710DF28C48065AF7E1FF88700F52882EEA999B311D374E989CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001D990 Relevance: 16.6, APIs: 11, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E1001D990(intOrPtr* _a4) {
				char _v32;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t43;
				intOrPtr _t49;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				char _t60;
				void* _t64;
				intOrPtr _t71;
				intOrPtr* _t74;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				intOrPtr* _t82;

				_t82 = _t81 - 0x4c;
				_t77 = _a4;
				_t80 =  *((intOrPtr*)(_t77 + 4));
				_t79 =  *_a4;
				 *_t82 = 0x34;
				_v32 = 0;
				_t43 = E100265E0();
				_v36 = _t43;
				if(_t43 == 0) {
					L13:
					return 0;
				} else {
					 *_t82 = 0x14;
					 *((intOrPtr*)(_t43 + 4)) = E100265E0();
					_t66 = _v36;
					_t71 =  *((intOrPtr*)(_t66 + 4));
					if(_t71 == 0) {
						if(_v32 != 0) {
							goto L9;
						} else {
							goto L12;
						}
					} else {
						_t54 =  *((intOrPtr*)(_t79 + 0x1c));
						if(_t54 != 0) {
							 *_t82 = _t54;
							_v48 = _t71;
							_t55 = E100265E0();
							_t66 = _v36;
							 *((intOrPtr*)(_v48 + 4)) = _t55;
							_t49 =  *((intOrPtr*)(_t66 + 4));
							if( *((intOrPtr*)(_t49 + 4)) != 0) {
								goto L3;
							} else {
								if(_v32 != 0) {
									goto L9;
								} else {
									goto L11;
								}
							}
						} else {
							L3:
							_t56 =  *((intOrPtr*)(_t79 + 0x18));
							if(_t56 != 0) {
								 *_t82 = _t56;
								 *((intOrPtr*)(_t66 + 0x10)) = E100265E0();
								if( *((intOrPtr*)(_v36 + 0x10)) != 0) {
									goto L4;
								} else {
									goto L8;
								}
							} else {
								L4:
								 *_t82 = _t77;
								_t60 = L10009FC0(_t66, 0);
								_v32 = _t60;
								if(_t60 == 0) {
									L10:
									_t66 = _v36;
									_t49 =  *((intOrPtr*)(_t66 + 4));
									if(_t49 != 0) {
										L11:
										 *_t82 = _t49 + 4;
										E100265C0();
										_t66 = _v36;
									}
									L12:
									 *_t82 = _t66 + 4;
									E100265C0();
									 *_t82 = _v36 + 0x10;
									E100265C0();
									 *_t82 =  &_v36;
									E100265C0();
									goto L13;
								} else {
									_v84 = E1001D7A0;
									_t66 = 1;
									_v88 = 0x34;
									_v76 = 1;
									_v80 = 0;
									 *_t82 = _v36;
									_t64 = L10009E60(1, 0, _t79, _t80);
									if(_t64 == 0) {
										L8:
										if(_v32 != 0) {
											L9:
											 *_t82 =  &_v32;
											E1000A000(_t66, _t79);
										}
										goto L10;
									} else {
										_t74 = _v36;
										 *_t74 = 0x100b32a0;
										 *((intOrPtr*)(_t74 + 8)) = _v32;
										 *((intOrPtr*)(_t74 + 0xc)) = _t80;
										 *((intOrPtr*)(_t74 + 0x24)) = 0xffffffff;
										 *((intOrPtr*)(_t74 + 0x28)) = 0xffffffff;
										 *((intOrPtr*)( *((intOrPtr*)(_t74 + 4)))) = _t79;
										return _t64;
									}
								}
							}
						}
					}
				}
			}

0x1001d996
0x1001d999
0x1001d99d
0x1001d9a3
0x1001d9a5
0x1001d9ac
0x1001d9b0
0x1001d9b5
0x1001d9bb
0x1001dade
0x1001dae7
0x1001d9c1
0x1001d9c1
0x1001d9cf
0x1001d9d2
0x1001d9d6
0x1001d9db
0x1001db2e
0x00000000
0x1001db34
0x00000000
0x1001db34
0x1001d9e1
0x1001d9e1
0x1001d9e6
0x1001daf0
0x1001daf3
0x1001daf7
0x1001db00
0x1001db04
0x1001db07
0x1001db0f
0x00000000
0x1001db15
0x1001db1b
0x00000000
0x1001db21
0x00000000
0x1001db21
0x1001db1b
0x1001d9ec
0x1001d9ec
0x1001d9ec
0x1001d9f1
0x1001da70
0x1001da78
0x1001da84
0x00000000
0x00000000
0x00000000
0x00000000
0x1001d9f3
0x1001d9f3
0x1001d9f3
0x1001d9f6
0x1001d9fb
0x1001da01
0x1001da9e
0x1001da9e
0x1001daa2
0x1001daa7
0x1001daa9
0x1001daac
0x1001daaf
0x1001dab4
0x1001dab4
0x1001dab8
0x1001dabb
0x1001dabe
0x1001daca
0x1001dacd
0x1001dad6
0x1001dad9
0x00000000
0x1001da07
0x1001da0e
0x1001da17
0x1001da1c
0x1001da24
0x1001da28
0x1001da2c
0x1001da2f
0x1001da36
0x1001da8a
0x1001da90
0x1001da92
0x1001da96
0x1001da99
0x1001da99
0x00000000
0x1001da38
0x1001da38
0x1001da40
0x1001da46
0x1001da49
0x1001da4c
0x1001da53
0x1001da5d
0x1001da66
0x1001da66
0x1001da36
0x1001da01
0x1001d9f1
0x1001d9e6
0x1001d9db

APIs

mv_mallocz.MAIN ref: 1001D9B0
mv_mallocz.MAIN ref: 1001D9CA
mv_buffer_ref.MAIN ref: 1001D9F6

Part of subcall function 10009FC0: mv_mallocz.MAIN ref: 10009FD2

mv_buffer_create.MAIN ref: 1001DA2F

Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009E86
Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009EBF

mv_mallocz.MAIN ref: 1001DA73
mv_buffer_unref.MAIN ref: 1001DA99
mv_freep.MAIN ref: 1001DAAF
mv_freep.MAIN ref: 1001DABE
mv_freep.MAIN ref: 1001DACD
mv_freep.MAIN ref: 1001DAD9
mv_mallocz.MAIN ref: 1001DAF7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unref
String ID:
API String ID: 2772056172-0
Opcode ID: f78fb1774a9b6c4d14d1ed364c0b54d703b3fc5897b42f1e152435b2e8f7f7ef
Instruction ID: 961086c667dc9f8e49421d039f7100c0425955bc0778363e0507aedae6c66dfa
Opcode Fuzzy Hash: f78fb1774a9b6c4d14d1ed364c0b54d703b3fc5897b42f1e152435b2e8f7f7ef
Instruction Fuzzy Hash: 1741E9B46087419FD740EF29D48061AFBE4FF88294F85896EF8998B355E735E881CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1008F920 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E1008F920() {
				signed int _t63;
				signed int _t64;
				signed int _t65;
				signed int _t66;
				signed int _t68;
				signed int _t69;
				signed int _t71;
				signed int _t84;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				void* _t90;
				signed int _t91;
				void* _t97;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t125;
				signed int _t126;
				signed int _t128;
				char* _t129;
				void* _t131;
				signed int* _t132;

				_t132 = _t131 - 0x3c;
				_t125 = _t132[0x14];
				if(_t132[0x15] != 0) {
					_t63 = _t132[0x15];
					 *_t63 = _t125;
				}
				if(_t132[0x16] == 1) {
					L29:
					L1009DB58();
					 *_t63 = 0x21;
					goto L30;
				} else {
					if(_t132[0x16] <= 0x24) {
						while(1) {
							_t65 =  *_t125;
							 *_t132 = _t65;
							_t87 = _t65;
							L1009DC10();
							if(_t65 == 0) {
								break;
							}
							_t125 = _t125 + 1;
						}
						_t120 = _t87;
						_t88 = _t65;
						_t6 = _t120 - 0x2b; // -43
						_t66 = _t120;
						if((_t6 & 0x000000fd) == 0) {
							_t66 =  *(_t125 + 1) & 0x000000ff;
							_t125 = _t125 + 1;
						}
						if(_t132[0x16] != 0) {
							if(_t132[0x16] != 0x10 || _t66 != 0x30) {
								goto L11;
							} else {
								if(( *(_t125 + 1) & 0xdf) == 0x58) {
									goto L34;
								} else {
									_t132[9] = 0x10;
									_t129 = _t125 + 1;
									_t68 = 0;
									goto L16;
								}
							}
						} else {
							_t132[0x16] = 0xa;
							if(_t66 == 0x30) {
								if(( *(_t125 + 1) & 0xdf) != 0x58) {
									_t132[9] = 8;
									_t132[0x16] = 8;
									goto L45;
								} else {
									L34:
									_t66 =  *(_t125 + 2) & 0x000000ff;
									_t132[0x16] = 0x10;
									_t125 = _t125 + 2;
									goto L11;
								}
							} else {
								L11:
								_t128 = _t66;
								if(_t128 - 0x30 <= 9) {
									_t132[9] = _t132[0x16];
									L45:
									_t68 = _t66 - 0x30;
									goto L15;
								} else {
									 *_t132 = _t128;
									L1009DC18();
									if(_t66 != 0) {
										_t68 = _t128 - 0x37;
										_t132[9] = _t132[0x16];
										goto L15;
									} else {
										 *_t132 = _t128;
										L1009DC08();
										if(_t66 == 0) {
											L30:
											_t64 = 0;
											goto L31;
										} else {
											_t68 = _t128 - 0x57;
											_t132[9] = _t132[0x16];
											L15:
											_t129 = _t125 + 1;
											if(_t68 >= _t132[9]) {
												goto L30;
											} else {
												L16:
												_t69 = _t132[0x16];
												_t132[0xa] = _t88;
												_t126 = _t68;
												_t132[6] = _t69;
												_t132[7] = _t69 >> 0x1f;
												_t71 = _t120;
												_t121 = _t68 >> 0x1f;
												_t132[0xb] = _t71;
												while(1) {
													_t89 =  *_t129;
													_t35 = _t89 - 0x30; // -96
													_t97 = _t35;
													if(_t97 <= 9) {
														goto L17;
													}
													 *_t132 = _t89;
													L1009DC18();
													if(_t71 == 0) {
														 *_t132 = _t89;
														L1009DC08();
														if(_t71 != 0) {
															_t90 = _t89 - 0x57;
															goto L18;
														}
													} else {
														_t90 = _t89 - 0x37;
														L18:
														if(_t90 < _t132[9]) {
															 *_t132 = 0xffffffff;
															_t132[1] = 0x7fffffff;
															_t132[2] = _t132[6];
															_t132[3] = _t132[7];
															_t71 = L1008EDE0() + 2;
															asm("adc edx, 0x0");
															asm("sbb edx, edi");
															if(_t71 < _t126) {
																_t132[0xa] = 1;
															} else {
																_t84 = _t126;
																_t71 = _t84 * _t132[0x16];
																_t121 = (_t84 * _t132[0x16] >> 0x20) + _t132[7] * _t126 + _t132[0x16] * _t121;
																_t126 = _t71 + _t90;
																asm("adc edi, ebx");
															}
															_t129 = _t129 + 1;
															continue;
														}
													}
													_t91 = _t132[0xa];
													_t132[7] = _t121;
													_t132[6] = _t126;
													_t122 = _t132[0xb] & 0x000000ff;
													if(_t132[0x15] != 0) {
														 *(_t132[0x15]) = _t129;
													}
													if(_t122 == 0x2d) {
														asm("sbb eax, ebp");
														if(0 < _t132[6] || _t91 != 0) {
															L1009DB58();
															 *0x80000000 = 0x22;
															_t64 = 0;
														} else {
															_t64 =  ~(_t132[6]);
															asm("adc edx, 0x0");
														}
														goto L31;
													} else {
														_t64 = _t132[6];
														if(_t132[7] < 0 || _t91 != 0) {
															L1009DB58();
															 *_t64 = 0x22;
															return 0xffffffff;
														} else {
															L31:
															return _t64;
														}
													}
													goto L51;
													L17:
													_t90 = _t97;
													goto L18;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L29;
					}
				}
				L51:
			}

0x1008f924
0x1008f92b
0x1008f931
0x1008f933
0x1008f937
0x1008f937
0x1008f93e
0x1008fad0
0x1008fad0
0x1008fad5
0x00000000
0x1008f944
0x1008f949
0x1008f953
0x1008f953
0x1008f956
0x1008f959
0x1008f95b
0x1008f962
0x00000000
0x00000000
0x1008f950
0x1008f950
0x1008f964
0x1008f966
0x1008f968
0x1008f96b
0x1008f973
0x1008f975
0x1008f979
0x1008f979
0x1008f982
0x1008faa5
0x00000000
0x1008fab3
0x1008fabc
0x00000000
0x1008fabe
0x1008fabe
0x1008fac6
0x1008fac9
0x00000000
0x1008fac9
0x1008fabc
0x1008f988
0x1008f988
0x1008f992
0x1008fb0a
0x1008fbf8
0x1008fc00
0x00000000
0x1008fb10
0x1008fb10
0x1008fb10
0x1008fb14
0x1008fb1c
0x00000000
0x1008fb1c
0x1008f998
0x1008f998
0x1008f998
0x1008f9a1
0x1008fbb4
0x1008fbb8
0x1008fbbb
0x00000000
0x1008f9a7
0x1008f9a7
0x1008f9aa
0x1008f9b1
0x1008faf4
0x1008faf7
0x00000000
0x1008f9b7
0x1008f9b7
0x1008f9ba
0x1008f9c1
0x1008fadb
0x1008fadb
0x00000000
0x1008f9c7
0x1008f9cb
0x1008f9ce
0x1008f9d8
0x1008f9dc
0x1008f9e1
0x00000000
0x1008f9e7
0x1008f9e7
0x1008f9eb
0x1008f9ef
0x1008f9f6
0x1008f9f8
0x1008f9ff
0x1008fa03
0x1008fa05
0x1008fa07
0x1008fa7a
0x1008fa7a
0x1008fa7e
0x1008fa7e
0x1008fa84
0x00000000
0x00000000
0x1008fa86
0x1008fa89
0x1008fa90
0x1008fb38
0x1008fb3b
0x1008fb42
0x1008fba0
0x00000000
0x1008fba0
0x1008fa96
0x1008fa96
0x1008fa12
0x1008fa18
0x1008fa26
0x1008fa2d
0x1008fa35
0x1008fa39
0x1008fa42
0x1008fa45
0x1008fa4a
0x1008fa4c
0x1008fb28
0x1008fa52
0x1008fa62
0x1008fa64
0x1008fa6c
0x1008fa73
0x1008fa75
0x1008fa75
0x1008fa77
0x00000000
0x1008fa77
0x1008fa18
0x1008fb48
0x1008fb4c
0x1008fb50
0x1008fb54
0x1008fb5b
0x1008fb61
0x1008fb61
0x1008fb67
0x1008fbd9
0x1008fbdb
0x1008fbe1
0x1008fbeb
0x1008fbf1
0x1008fc0a
0x1008fc12
0x1008fc14
0x1008fc17
0x00000000
0x1008fb69
0x1008fb6d
0x1008fb73
0x1008fb7d
0x1008fb87
0x1008fb99
0x1008fadf
0x1008fadf
0x1008fae6
0x1008fae6
0x1008fb73
0x00000000
0x1008fa10
0x1008fa10
0x00000000
0x1008fa10
0x1008fa7a
0x1008f9e1
0x1008f9c1
0x1008f9b1
0x1008f9a1
0x1008f992
0x1008f94b
0x00000000
0x1008f94b
0x1008f949
0x00000000

APIs

isspace.MSVCRT ref: 1008F95B
isupper.MSVCRT ref: 1008F9AA
islower.MSVCRT ref: 1008F9BA
isupper.MSVCRT ref: 1008FA89
_errno.MSVCRT ref: 1008FAD0

Strings

$, xrefs: 1008F944

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: isupper$_errnoislowerisspace
String ID: $
API String ID: 4095548146-3993045852
Opcode ID: 026cf13eb89308e961753ce655e2892c44d5266a6a8bc87b24ee3076e9ab9950
Instruction ID: 66d36e278e9387c17c28d7139ad898e7a92bf48a2b7880ad50bacd675aa30ae7
Opcode Fuzzy Hash: 026cf13eb89308e961753ce655e2892c44d5266a6a8bc87b24ee3076e9ab9950
Instruction Fuzzy Hash: C3718D70A083468BC704DF68C48062FBBE2FF893A4F25892FE9D997391D774D8458B42

Uniqueness

Uniqueness Score: -1.00%

Function 10023649 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E10023649(void* __edi, signed char* __ebp, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, unsigned int _a36, signed char* _a40, signed char* _a44, char _a48, signed char* _a1072, signed char* _a2096, signed char* _a3120, signed char* _a4144, intOrPtr _a4148, intOrPtr _a4152, signed int _a5204, char* _a5208, char* _a5212) {
				signed int _t63;
				signed int _t67;
				signed int _t70;
				signed int _t73;
				signed int _t76;
				signed int _t81;
				void* _t84;
				signed char* _t85;
				int _t87;
				signed char* _t88;
				intOrPtr _t92;
				signed char* _t93;
				char* _t102;
				signed char* _t103;
				signed char* _t104;
				signed char* _t105;
				signed char* _t106;
				char* _t107;
				char* _t122;
				signed int _t123;
				char* _t125;
				signed char* _t130;
				signed char** _t132;

				_t130 = __ebp;
				if(( *0x100d568c & 0x00000002) != 0) {
					_t51 = _a5204 + 8; // 0x101
					__edx = _t51;
					__eax = 0x100b367b;
					if(__edx <= 0x40) {
						__eax =  *((intOrPtr*)(0x100b3880 + __edx * 4));
					}
					_a8 = __eax;
					__eax = "[%s] ";
					_a4 = "[%s] ";
					 *__esp = __edi;
					__eax = E100089C0();
				}
				 *_t132 = _t130;
				_a8 = _a5212;
				_a4 = _a5208;
				E10008B70();
				_t107 = _a1072;
				_t102 = _a2096;
				_t122 = _a3120;
				_t125 = _a4144;
				if( *_t107 != 0 ||  *_t102 != 0 ||  *_t122 != 0 ||  *_t125 != 0) {
					_t92 = _a4148;
					_t63 = 0;
					if(_t92 != 0 && _a4152 >= _t92) {
						_t63 = (0 | ( *(_t125 + _t92 - 1) & 0x000000ff) == 0x0000000a |  *(_t125 + _t92 - 1) & 0 | ( *(_t125 + _t92 - 1) & 0x000000ff) == 0x0000000d) & 0x000000ff;
					}
					 *0x100aa00c = _t63;
				}
				_a24 = _t125;
				_t93 =  &_a48;
				_a8 = "%s%s%s%s";
				_a20 = _t122;
				_a16 = _t102;
				_a12 = _t107;
				_a4 = 0x400;
				 *_t132 = _t93;
				L10022FC0();
				_t67 =  *0x100d5680;
				if(_t67 == 0) {
					 *_t132 = 2;
					L1009DD30();
					asm("sbb eax, eax");
					 *0x100d5680 = _t67 | 0x00000001;
				}
				_t123 =  *0x100aa00c; // 0x1
				_t126 =  *0x100d5260;
				if(_t123 == 0 || ( *0x100d568c & 0x00000001) == 0) {
					L12:
					if(_t126 > 0) {
						 *_t132 = 2;
						_t123 = 0;
						_t85 =  *0x100aa0cc();
						_a8 = _t126;
						_t126 = "    Last message repeated %d times\n";
						_a4 = "    Last message repeated %d times\n";
						 *_t132 = _t85;
						E10022AF0();
						 *0x100d5260 = 0;
					}
					_a4 = _t93;
					 *_t132 = 0x100d5280;
					strcpy(??, ??);
					_t103 = _a1072;
					_t70 =  *_t103 & 0x000000ff;
					if(_t70 == 0) {
						L20:
						E10022C90(_a40, _t93, _t103, 0, _t123, _t126);
						_t104 = _a2096;
						_t73 =  *_t104 & 0x000000ff;
						if(_t73 == 0) {
							L26:
							E10022C90(_a44, _t93, _t104, 0, _t123, _t126);
							_t105 = _a3120;
							_t76 =  *_t105 & 0x000000ff;
							if(_t76 == 0) {
								L32:
								_t128 = _a36 >> 8;
								_t96 =  >  ? 7 : _a5204 >> 3;
								_t97 =  <  ? 0 :  >  ? 7 : _a5204 >> 3;
								E10022C90( <  ? 0 :  >  ? 7 : _a5204 >> 3,  <  ? 0 :  >  ? 7 : _a5204 >> 3, _t105, _a36 >> 8, _t123, _a36 >> 8);
								_t106 = _a4144;
								_t81 =  *_t106 & 0x000000ff;
								if(_t81 == 0) {
									L38:
									E10022C90(_t97, _t97, _t106, _t128, _t123, _t128);
									goto L39;
								}
								L34:
								while(_t81 - 0xe > 0x11 && _t81 > 7) {
									_t81 = _t106[1] & 0x000000ff;
									_t106 =  &(_t106[1]);
									if(_t81 != 0) {
										continue;
									}
									L37:
									_t106 = _a4144;
									goto L38;
								}
								 *_t106 = 0x3f;
								_t106 =  &(_t106[1]);
								_t81 =  *_t106 & 0x000000ff;
								if(_t81 != 0) {
									goto L34;
								}
								goto L37;
							}
							L28:
							while(_t76 - 0xe > 0x11 && _t76 > 7) {
								_t76 = _t105[1] & 0x000000ff;
								_t105 =  &(_t105[1]);
								if(_t76 != 0) {
									continue;
								}
								L31:
								_t105 = _a3120;
								goto L32;
							}
							 *_t105 = 0x3f;
							_t105 =  &(_t105[1]);
							_t76 =  *_t105 & 0x000000ff;
							if(_t76 != 0) {
								goto L28;
							}
							goto L31;
						}
						L22:
						while(_t73 - 0xe > 0x11 && _t73 > 7) {
							_t73 = _t104[1] & 0x000000ff;
							_t104 =  &(_t104[1]);
							if(_t73 != 0) {
								continue;
							}
							L25:
							_t104 = _a2096;
							goto L26;
						}
						 *_t104 = 0x3f;
						_t104 =  &(_t104[1]);
						_t73 =  *_t104 & 0x000000ff;
						if(_t73 != 0) {
							goto L22;
						}
						goto L25;
					} else {
						L16:
						while(_t70 - 0xe > 0x11 && _t70 > 7) {
							_t70 = _t103[1] & 0x000000ff;
							_t103 =  &(_t103[1]);
							if(_t70 != 0) {
								continue;
							}
							L19:
							_t103 = _a1072;
							goto L20;
						}
						 *_t103 = 0x3f;
						_t103 =  &(_t103[1]);
						_t70 =  *_t103 & 0x000000ff;
						if(_t70 != 0) {
							goto L16;
						}
						goto L19;
					}
				} else {
					 *_t132 = _t93;
					_t106 = 0x100d5280;
					_a4 = 0x100d5280;
					_t87 = strcmp(??, ??);
					if(_t87 != 0) {
						goto L12;
					}
					if(_a48 != 0) {
						 *_t132 = _t93;
						L1009DCB0();
						if( *((char*)(_t132 + _t87 + 0x2f)) == 0xd) {
							goto L12;
						}
						_t128 =  &(_t126[1]);
						 *0x100d5260 = _t128;
						if( *0x100d5680 == 1) {
							 *_t132 = 2;
							_t88 =  *0x100aa0cc();
							_a8 = _t128;
							_a4 = "    Last message repeated %d times\r";
							 *_t132 = _t88;
							E10022AF0();
						}
						L39:
						 *_t132 = _t130;
						_a4 = 0;
						_t84 = E10009690(0, _t106, _t123, _t128);
						 *_t132 = 0x100d5690;
						L1009DE50();
						return _t84;
					}
					goto L12;
				}
			}

0x10023649
0x10023657
0x10023664
0x10023664
0x10023667
0x1002366f
0x1002369e
0x1002369e
0x10023671
0x10023675
0x1002367a
0x1002367e
0x10023681
0x10023681
0x10023274
0x1002327e
0x10023289
0x1002328d
0x10023292
0x10023299
0x100232a0
0x100232a7
0x100232b1
0x100234f0
0x100234f7
0x100234fb
0x10023519
0x10023519
0x1002351c
0x1002351c
0x100232e0
0x100232e4
0x100232ed
0x100232f6
0x100232fa
0x100232fe
0x10023302
0x10023306
0x10023309
0x1002330e
0x10023315
0x10023590
0x10023597
0x1002359f
0x100235a4
0x100235a4
0x1002331b
0x10023321
0x10023329
0x10023360
0x10023362
0x10023364
0x1002336b
0x1002336d
0x10023373
0x10023377
0x1002337c
0x10023380
0x10023383
0x10023388
0x10023388
0x1002338e
0x10023392
0x10023399
0x1002339e
0x100233a5
0x100233aa
0x100233d6
0x100233dc
0x100233e1
0x100233e8
0x100233ed
0x10023416
0x1002341c
0x10023421
0x10023428
0x1002342d
0x10023456
0x10023469
0x1002346e
0x10023477
0x1002347c
0x10023481
0x10023488
0x1002348d
0x100234b6
0x100234ba
0x00000000
0x100234ba
0x00000000
0x10023490
0x100234a6
0x100234aa
0x100234ad
0x00000000
0x00000000
0x100234af
0x100234af
0x00000000
0x100234af
0x10023548
0x1002354b
0x1002354c
0x10023551
0x00000000
0x00000000
0x00000000
0x10023557
0x00000000
0x10023430
0x10023446
0x1002344a
0x1002344d
0x00000000
0x00000000
0x1002344f
0x1002344f
0x00000000
0x1002344f
0x10023530
0x10023533
0x10023534
0x10023539
0x00000000
0x00000000
0x00000000
0x1002353f
0x00000000
0x100233f0
0x10023406
0x1002340a
0x1002340d
0x00000000
0x00000000
0x1002340f
0x1002340f
0x00000000
0x1002340f
0x10023560
0x10023563
0x10023564
0x10023569
0x00000000
0x00000000
0x00000000
0x100233b0
0x00000000
0x100233b0
0x100233c6
0x100233ca
0x100233cd
0x00000000
0x00000000
0x100233cf
0x100233cf
0x00000000
0x100233cf
0x10023578
0x1002357b
0x1002357c
0x10023581
0x00000000
0x00000000
0x00000000
0x10023587
0x10023334
0x10023334
0x10023337
0x1002333c
0x10023340
0x10023347
0x00000000
0x00000000
0x1002334e
0x100236a7
0x100236aa
0x100236b4
0x00000000
0x00000000
0x100236ba
0x100236c2
0x100236c8
0x100236ce
0x100236d5
0x100236e0
0x100236e4
0x100236e8
0x100236eb
0x100236eb
0x100234bf
0x100234bf
0x100234c4
0x100234c8
0x100234cd
0x100234d4
0x100234e6
0x100234e6
0x00000000
0x1002334e

APIs

mv_vbprintf.MAIN ref: 1002328D
strcmp.MSVCRT ref: 10023340
strcpy.MSVCRT ref: 10023399
mv_bprint_finalize.MAIN ref: 100234C8
ReleaseSRWLockExclusive.KERNEL32 ref: 100234D4
mv_bprintf.MAIN ref: 10023681

Strings

%s%s%s%s, xrefs: 100232E8
[%s] , xrefs: 10023675
Last message repeated %d times, xrefs: 10023377

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLockReleasemv_bprint_finalizemv_bprintfmv_vbprintfstrcmpstrcpy
String ID: Last message repeated %d times$%s%s%s%s$[%s]
API String ID: 4275616186-1378087399
Opcode ID: d0df824065387cbc24c48f67f203688572bdbcaedd198ee8c4ff34e36a2db307
Instruction ID: 3a5394bdbcfdd3d39a4a44ba34fc3df736875c3267acf4b9896f0e29f48a5ef2
Opcode Fuzzy Hash: d0df824065387cbc24c48f67f203688572bdbcaedd198ee8c4ff34e36a2db307
Instruction Fuzzy Hash: B161BE749087959FD720DF24D4803AABBE2FF85384F95884EE8C957342C736E985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002CB80 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002CC28

Strings

Invalid option type., xrefs: 1002CFE0
The "%s" option is deprecated: %s, xrefs: 1002CC03

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: Invalid option type.$The "%s" option is deprecated: %s
API String ID: 2835281190-3987454512
Opcode ID: c1ec0b95e216cf99103c8c3e5479d083ebba5e65393788632e22c9499eb76c6a
Instruction ID: da891f098d89691d2da580ee413da83234d9562dfb943954d3a56cfaf5a0d1d4
Opcode Fuzzy Hash: c1ec0b95e216cf99103c8c3e5479d083ebba5e65393788632e22c9499eb76c6a
Instruction Fuzzy Hash: 37410978A087498FC750DF69D081A1EF7E0EF89750FA2892EE99987351DB34DC40DB82

Uniqueness

Uniqueness Score: -1.00%

Function 10019970 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 100199A3
mv_malloc.MAIN ref: 100199AE
mv_log.MAIN ref: 10019A78

Part of subcall function 1008F820: strlen.MSVCRT ref: 1008F832
Part of subcall function 1008F820: _errno.MSVCRT ref: 1008F850

_errno.MSVCRT ref: 10019A21
mv_log.MAIN ref: 10019A4E
mv_freep.MAIN ref: 10019A56

Strings

./%sXXXXXX, xrefs: 100199FC
ff_tempfile: Cannot open temporary file %s, xrefs: 10019A45
/tmp/%sXXXXXX, xrefs: 100199C1

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _errnomv_logstrlen$mv_freepmv_malloc
String ID: ./%sXXXXXX$/tmp/%sXXXXXX$ff_tempfile: Cannot open temporary file %s
API String ID: 3823847272-2791948529
Opcode ID: 9fcd766a609fa42d1e131dfce7f93293598c381c48a3ec19530fb229cde90f30
Instruction ID: ca396602fb1ee98faa866fa63a7723223a79ba1d365e5aad02c347e39299c69d
Opcode Fuzzy Hash: 9fcd766a609fa42d1e131dfce7f93293598c381c48a3ec19530fb229cde90f30
Instruction Fuzzy Hash: B73179B89087419FC340EF29C18151AFBE0FF88650F91892EF9C99B311E775E9859F82

Uniqueness

Uniqueness Score: -1.00%

Function 10009130 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 272
stringCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E10009130() {
				int _t86;
				void* _t91;
				void* _t93;
				signed char _t99;
				void* _t111;
				signed char _t113;
				void* _t114;
				void* _t118;
				signed char _t119;
				void* _t121;
				int _t122;
				void* _t123;
				unsigned int _t124;
				unsigned int _t125;
				signed int _t126;
				void* _t130;
				void* _t131;
				int _t132;
				void* _t136;
				signed char _t139;
				signed char _t141;
				void* _t142;
				void* _t143;
				signed int _t144;
				int _t145;
				void* _t147;
				signed int _t148;
				signed int _t151;
				int _t153;
				signed int _t154;
				void _t158;
				void* _t159;
				char* _t161;
				void** _t162;
				void* _t165;
				void* _t166;
				void** _t167;
				void*** _t168;

				_t86 = _t168[0x111];
				_t167 = _t168[0x110];
				if( *_t86 == 0) {
					L40:
					return _t86;
				} else {
					_t118 = _t167[2];
					while(1) {
						_t145 = _t167[1];
						_t88 =  <=  ? _t145 : _t118;
						_t121 = _t118 - ( <=  ? _t145 : _t118);
						if(_t121 != 0) {
							goto L15;
						}
						 *_t168 = _t168[0x111];
						_t9 = strlen(??) + 1; // 0x1
						_t159 = _t9;
						L11:
						_t124 = _t167[3];
						if(_t124 == _t118 || _t145 >= _t118) {
							L22:
							_t95 =  <=  ? _t118 : _t145;
							_t119 = _t118 - ( <=  ? _t118 : _t145);
							if(_t119 > 0x3ff) {
								L26:
								_t139 = _t119;
								_t147 =  *_t167 + _t145;
								if(_t119 >= 8) {
									if((_t147 & 0x00000001) != 0) {
										 *_t147 = 0x21;
										_t139 = _t119 - 1;
										_t147 = _t147 + 1;
									}
									if((_t147 & 0x00000002) != 0) {
										 *_t147 = 0x2121;
										_t139 = _t139 - 2;
										_t147 = _t147 + 2;
									}
									if((_t147 & 0x00000004) != 0) {
										 *_t147 = 0x21212121;
										_t139 = _t139 - 4;
										_t147 = _t147 + 4;
									}
									_t125 = _t139;
									_t139 = _t139 & 0x00000003;
									_t126 = _t125 >> 2;
									memset(_t147, 0x21212121, _t126 << 2);
									_t168 =  &(_t168[3]);
									_t147 = _t147 + _t126;
									if((_t139 & 0x00000004) == 0) {
										goto L29;
									} else {
										goto L28;
									}
									goto L40;
								} else {
									if((_t139 & 0x00000004) != 0) {
										L28:
										 *_t147 = 0x21212121;
										_t147 = _t147 + 4;
									}
								}
								L29:
								if((_t139 & 0x00000002) != 0) {
									 *_t147 = 0x2121;
									_t147 = _t147 + 2;
								}
								if((_t139 & 0x00000001) != 0) {
									 *_t147 = 0x21;
								}
								_t161 = "[truncated strftime output]";
								_t99 =  <=  ? _t119 : 0x1b;
								_t141 =  *_t167 + _t167[1];
								if(0x1b >= 4) {
									if((_t141 & 0x00000001) != 0) {
										_t141 = _t141 + 1;
										_t161 = "truncated strftime output]";
										_t99 = _t99 - 1;
										 *((char*)(_t141 - 1)) = "[truncated strftime output]" & 0x000000ff;
									}
									if((_t141 & 0x00000002) != 0) {
										_t148 =  *_t161 & 0x0000ffff;
										_t141 = _t141 + 2;
										_t161 =  &(_t161[2]);
										_t99 = _t99 - 2;
										 *(_t141 - 2) = _t148;
									}
									if(_t99 >= 4) {
										_t168[7] = _t99;
										_t131 = 0;
										_t151 = _t99 & 0xfffffffc;
										do {
											 *(_t141 + _t131) = _t161[_t131];
											_t131 = _t131 + 4;
										} while (_t131 < _t151);
										_t99 = _t168[7];
										_t141 = _t141 + _t131;
										_t161 =  &(_t161[_t131]);
									}
								}
								_t130 = 0;
								if((_t99 & 0x00000002) != 0) {
									_t130 = 2;
									 *_t141 =  *_t161 & 0x0000ffff;
								}
								if((_t99 & 0x00000001) != 0) {
									 *((char*)(_t141 + _t130)) = _t161[_t130] & 0x000000ff;
								}
								_t142 = _t167[1];
								_t102 =  >  ? _t119 : 0xfffffffa - _t142;
								_t86 = ( >  ? _t119 : 0xfffffffa - _t142) + _t142;
								_t136 = _t167[2];
								_t167[1] = 0xfffffffa;
								if(_t136 != 0) {
									L39:
									_t138 =  >  ? _t86 : _t136 - 1;
									_t93 =  *_t167;
									 *((char*)(_t93 + ( >  ? _t86 : _t136 - 1))) = 0;
									return _t93;
								}
								goto L40;
							} else {
								_t162 =  &(_t168[8]);
								 *_t168 = _t162;
								_t168[3] = _t168[0x112];
								_t168[2] = _t168[0x111];
								_t86 = 0x400;
								_t168[1] = 0x400;
								L1009DCA8();
								if(0x400 != 0) {
									_t168[2] = _t162;
									_t168[1] = 0x100ac500;
									 *_t168 = _t167;
									return E100089C0();
								} else {
									if(_t119 != 0) {
										_t145 = _t167[1];
										goto L26;
									}
									goto L40;
								}
							}
						} else {
							_t110 =  >  ? _t159 : 0xfffffffe - _t145;
							_t111 = _t145 + ( >  ? _t159 : 0xfffffffe - _t145) + 1;
							if(_t124 >> 1 >= _t118) {
								_t118 = _t118 + _t118;
							} else {
								_t118 = _t124;
							}
							if(_t118 < _t111) {
								_t115 =  <=  ? _t124 : _t111;
								_t118 =  <=  ? _t124 : _t111;
							}
							_t165 =  *_t167;
							_t168[1] = _t118;
							if(_t165 ==  &(_t167[4])) {
								 *_t168 = 0;
								_t113 = E10026280();
								if(_t113 == 0) {
									goto L21;
								} else {
									goto L19;
								}
							} else {
								 *_t168 = _t165;
								_t113 = E10026280();
								if(_t113 == 0) {
									L21:
									_t118 = _t167[2];
									_t145 = _t167[1];
									goto L22;
								} else {
									if(_t165 == 0) {
										L19:
										_t153 = _t167[1];
										_t143 = _t113;
										_t166 =  *_t167;
										_t132 = _t153 + 1;
										_t168[7] = _t166;
										if(_t132 >= 8) {
											if((_t113 & 0x00000001) != 0) {
												_t144 =  *_t166 & 0x000000ff;
												_t132 = _t153;
												_t166 = _t166 + 1;
												 *_t113 = _t144;
												_t82 = _t113 + 1; // 0x1
												_t143 = _t82;
											}
											if((_t143 & 0x00000002) != 0) {
												_t154 =  *_t166 & 0x0000ffff;
												_t143 = _t143 + 2;
												_t166 = _t166 + 2;
												_t132 = _t132 - 2;
												 *(_t143 - 2) = _t154;
											}
											if((_t143 & 0x00000004) != 0) {
												_t158 =  *_t166;
												_t143 = _t143 + 4;
												_t166 = _t166 + 4;
												_t132 = _t132 - 4;
												 *(_t143 - 4) = _t158;
											}
										}
										_t114 = memcpy(_t143, _t166, _t132);
										_t168 =  &(_t168[3]);
									}
									 *_t167 = _t114;
									_t167[2] = _t118;
									continue;
								}
							}
						}
						goto L66;
						L15:
						_t168[1] = _t121;
						_t168[7] = _t121;
						_t168[3] = _t168[0x112];
						_t168[2] = _t168[0x111];
						_t91 =  *_t167;
						 *_t168 = _t91 + _t145;
						L1009DCA8();
						if(_t91 != 0) {
							_t122 = _t167[1];
							_t92 =  <=  ? 0xfffffffa - _t122 : _t91;
							_t136 = _t167[2];
							_t86 = ( <=  ? 0xfffffffa - _t122 : _t91) + _t122;
							_t167[1] = _t86;
							if(_t136 != 0) {
								goto L39;
							}
							goto L40;
						} else {
							_t123 = _t168[7];
							_t159 = 0x7fffffff;
							_t145 = _t167[1];
							_t118 = _t167[2];
							if(_t123 <= 0x3fffffff) {
								_t159 = _t123 + _t123;
							}
							goto L11;
						}
						goto L66;
					}
				}
				L66:
			}

0x1000913a
0x10009141
0x1000914b
0x10009377
0x10009377
0x10009151
0x10009151
0x1000919d
0x1000919d
0x100091a6
0x100091a9
0x100091ab
0x00000000
0x00000000
0x100091b4
0x100091bc
0x100091bc
0x100091bf
0x100091bf
0x100091c4
0x10009287
0x1000928b
0x1000928e
0x10009296
0x100092d6
0x100092d9
0x100092db
0x100092e0
0x100093f6
0x100094c6
0x100094c9
0x100094cc
0x100094cc
0x10009402
0x100094b6
0x100094bb
0x100094be
0x100094be
0x1000940e
0x100094a5
0x100094ab
0x100094ae
0x100094ae
0x10009414
0x10009416
0x10009419
0x10009421
0x10009421
0x10009421
0x10009426
0x00000000
0x1000942c
0x00000000
0x1000942c
0x00000000
0x100092e6
0x100092e9
0x100092eb
0x100092eb
0x100092f1
0x100092f1
0x100092e9
0x100092f4
0x100092f7
0x100092f9
0x100092fe
0x100092fe
0x10009304
0x10009306
0x10009306
0x10009311
0x1000931b
0x1000931e
0x10009323
0x100093b3
0x100094ee
0x100094ef
0x100094f4
0x100094f5
0x100094f5
0x100093bc
0x100094d2
0x100094d5
0x100094d8
0x100094db
0x100094de
0x100094de
0x100093c5
0x100093cb
0x100093d1
0x100093d3
0x100093d6
0x100093d9
0x100093dc
0x100093df
0x100093e3
0x100093e7
0x100093e9
0x100093e9
0x100093c5
0x10009329
0x1000932d
0x10009332
0x10009337
0x10009337
0x1000933c
0x10009342
0x10009342
0x10009345
0x10009351
0x10009354
0x10009356
0x10009359
0x1000935e
0x10009360
0x10009363
0x10009366
0x10009369
0x00000000
0x10009369
0x00000000
0x10009298
0x1000929f
0x100092a3
0x100092a6
0x100092b1
0x100092b5
0x100092ba
0x100092be
0x100092c5
0x10009460
0x10009469
0x1000946d
0x1000947f
0x100092cb
0x100092cd
0x100092d3
0x00000000
0x100092d3
0x00000000
0x100092cd
0x100092c5
0x100091d2
0x100091db
0x100091e2
0x100091e8
0x10009160
0x100091ee
0x100091ee
0x100091ee
0x10009164
0x10009168
0x1000916b
0x1000916b
0x1000916d
0x10009173
0x10009179
0x10009250
0x10009257
0x1000925e
0x00000000
0x00000000
0x00000000
0x00000000
0x1000917f
0x1000917f
0x10009182
0x10009189
0x10009281
0x10009281
0x10009284
0x00000000
0x1000918f
0x10009191
0x10009260
0x10009260
0x10009263
0x10009265
0x10009268
0x1000926b
0x10009272
0x10009382
0x10009495
0x10009498
0x1000949a
0x1000949b
0x1000949d
0x1000949d
0x1000949d
0x1000938b
0x10009480
0x10009483
0x10009486
0x10009489
0x1000948c
0x1000948c
0x10009394
0x1000939a
0x1000939c
0x1000939f
0x100093a2
0x100093a5
0x100093a5
0x10009394
0x1000927a
0x1000927a
0x1000927a
0x10009197
0x1000919a
0x00000000
0x1000919a
0x10009189
0x10009179
0x00000000
0x100091f8
0x100091f8
0x10009203
0x10009207
0x10009212
0x10009216
0x1000921b
0x1000921e
0x10009225
0x10009438
0x10009444
0x10009447
0x1000944a
0x1000944c
0x10009451
0x00000000
0x10009457
0x00000000
0x1000922b
0x1000922b
0x1000922f
0x10009234
0x10009237
0x10009240
0x10009246
0x10009246
0x00000000
0x10009240
0x00000000
0x10009225
0x1000919d
0x00000000

APIs

mv_realloc.MAIN ref: 10009182
strlen.MSVCRT ref: 100091B7
strftime.MSVCRT ref: 1000921E

Strings

[truncated strftime output], xrefs: 10009311
!!!!, xrefs: 1000941C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_reallocstrftimestrlen
String ID: !!!!$[truncated strftime output]
API String ID: 709960874-1743851734
Opcode ID: f29f42bb8ffea11f48ea5e99c1610936806f5c95083409d1b8b746ef61fd5416
Instruction ID: 5e96dacd8902ef441cde7e6f7e331d45904ef3b1d824b749351cd4a48aad1636
Opcode Fuzzy Hash: f29f42bb8ffea11f48ea5e99c1610936806f5c95083409d1b8b746ef61fd5416
Instruction Fuzzy Hash: FFA1BFB1A042429FE710CF28C98579E77E2EF843D0F268529ED898B399E735DD45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 1008FC20 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 1008FC5B
isupper.MSVCRT ref: 1008FCAA
islower.MSVCRT ref: 1008FCBA
isupper.MSVCRT ref: 1008FD99
_errno.MSVCRT ref: 1008FDE0

Strings

$, xrefs: 1008FC44

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: isupper$_errnoislowerisspace
String ID: $
API String ID: 4095548146-3993045852
Opcode ID: 15051ec53031f1e074764a69e26142ddc0f49a614da5c14c707b5b7ec2a775f1
Instruction ID: c0db5192c107e01fe07cf4e52f80c4d6fa2fe53ca14def51bf77d1d27da3288f
Opcode Fuzzy Hash: 15051ec53031f1e074764a69e26142ddc0f49a614da5c14c707b5b7ec2a775f1
Instruction Fuzzy Hash: 3461C470A083468BC704DF39C88022EBBD3FFC9354F55892FEA958B391E674D9458741

Uniqueness

Uniqueness Score: -1.00%

Function 1002C736 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 128stringCOMMON

Download Yara Rule

APIs

mv_expr_parse_and_eval.MAIN ref: 1002C5F5
strcmp.MSVCRT ref: 1002C6CE
mv_log.MAIN ref: 1002C99D

Strings

none, xrefs: 1002C54A
max, xrefs: 1002C505
default, xrefs: 1002C4D2
min, xrefs: 1002C51F
all, xrefs: 1002C56F
9, xrefs: 1002C740

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_parse_and_evalmv_logstrcmp
String ID: 9$all$default$max$min$none
API String ID: 638344568-340763830
Opcode ID: cbd95094e55aa019dd321054222498a877d501c9dab8c4b56b7ccccdadb64703
Instruction ID: 411126b03e5c4c9fee0fee3cc8844fcbddd9a5d1040519b46a4fb5c1d41167ed
Opcode Fuzzy Hash: cbd95094e55aa019dd321054222498a877d501c9dab8c4b56b7ccccdadb64703
Instruction Fuzzy Hash: EC514A7590974A8BC351EF68E04469BF7E5FF89344F518A2EE9C9D7200EB70E9048B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000C2D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

mv_bprint_init_for_buffer.MAIN ref: 1000C308
mv_bprintf.MAIN ref: 1000C330

Strings

AMBI%d, xrefs: 1000C394
USR%d, xrefs: 1000C37C
NONE, xrefs: 1000C327

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init_for_buffermv_bprintf
String ID: AMBI%d$NONE$USR%d
API String ID: 2490314137-3656852315
Opcode ID: 18c3f00c932525b9a03c6c26bd996f108cdefc78bc7c7bb15c7cae72aa0d9e7e
Instruction ID: 1ef98ca077266c32d1aee9727dfec110bedddac347624ae906d8e5fb6b24c5a3
Opcode Fuzzy Hash: 18c3f00c932525b9a03c6c26bd996f108cdefc78bc7c7bb15c7cae72aa0d9e7e
Instruction Fuzzy Hash: 20114FB4918B55CBE714EF28C480A5EB7E0FF88780F51C92EF68897254D334AE419B97

Uniqueness

Uniqueness Score: -1.00%

Function 1000C470 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

mv_bprint_init_for_buffer.MAIN ref: 1000C4A8
mv_bprintf.MAIN ref: 1000C4D0

Strings

ambisonic ACN %d, xrefs: 1000C534
none, xrefs: 1000C4C7
user %d, xrefs: 1000C51C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init_for_buffermv_bprintf
String ID: ambisonic ACN %d$none$user %d
API String ID: 2490314137-4180635230
Opcode ID: 6d247fa50da3d5541497e9d82b9e4f8f3eef7e7a432eeee65763f77ec15faa69
Instruction ID: c94b059796d13185444bee4ca381abcd6d61be9244a4282c7920a982e5d4d1e4
Opcode Fuzzy Hash: 6d247fa50da3d5541497e9d82b9e4f8f3eef7e7a432eeee65763f77ec15faa69
Instruction Fuzzy Hash: 51112EB4908B55CBE320DF24D480A6EB7E0FF847C4F51882EF59887289D734A941DB97

Uniqueness

Uniqueness Score: -1.00%

Function 10039D3B Relevance: 13.8, APIs: 11, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10039D65
strcmp.MSVCRT ref: 10039D7D
strcmp.MSVCRT ref: 10039D95
strcmp.MSVCRT ref: 10039DAD
strcmp.MSVCRT ref: 10039DC5
strcmp.MSVCRT ref: 10039DDD
strcmp.MSVCRT ref: 10039DF5
strcmp.MSVCRT ref: 10039E0D
strcmp.MSVCRT ref: 10039E25
strcmp.MSVCRT ref: 10039E3D
strcmp.MSVCRT ref: 10039E51

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: e09b1fcfb1c73acedfc3745fd5e3e58ea55c7d48bc397e90a55024912ae0d87c
Instruction ID: 5f20845c35538d82dc591f8b437476df06d8332b2c7058219b19cda39d9e3166
Opcode Fuzzy Hash: e09b1fcfb1c73acedfc3745fd5e3e58ea55c7d48bc397e90a55024912ae0d87c
Instruction Fuzzy Hash: 30310EB85083428ED751EF59854171EBAD1EF45A86F868C2EE88C8B242D7B8D940E723

Uniqueness

Uniqueness Score: -1.00%

Function 1001B8D0 Relevance: 13.8, APIs: 9, Instructions: 250COMMON

Download Yara Rule

APIs

mv_channel_layout_check.MAIN ref: 1001B920
mv_sample_fmt_is_planar.MAIN ref: 1001B942
mv_channel_layout_check.MAIN ref: 1001B9B7
mv_hwframe_transfer_data.MAIN ref: 1001BAE3

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_check$mv_hwframe_transfer_datamv_sample_fmt_is_planar
String ID:
API String ID: 1553998843-0
Opcode ID: 6cac879977a8b13244bde48582e16f82ac97cff3938bce88e986ecd715483f6d
Instruction ID: 72df875d59b9fd1ba8d0ac85d53e609cc354b7ecb43e3e539226396dea563104
Opcode Fuzzy Hash: 6cac879977a8b13244bde48582e16f82ac97cff3938bce88e986ecd715483f6d
Instruction Fuzzy Hash: 72A11E74604B458BD758DF26C0C162BBBE2FFC4694F158A2DD9998F719E730E882CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1004CA17 Relevance: 13.7, APIs: 9, Instructions: 185COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13
mv_tree_find.MAIN ref: 1004CBB8
mv_tree_find.MAIN ref: 1004CBD3
mv_tree_find.MAIN ref: 1004CC31

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: c36327b2d25d5fe4884ec1989afda76d5058c06c978ad9fa8712f8f68075efe0
Instruction ID: 53801cd7259bdacf3f476d6e8c3942157b86ee63cd70a90bc861ee9562dfc515
Opcode Fuzzy Hash: c36327b2d25d5fe4884ec1989afda76d5058c06c978ad9fa8712f8f68075efe0
Instruction Fuzzy Hash: EB81DFB490974A9FC340DF6AC18091AFBE5FF88654F61892EE898D7311E734E941CF86

Uniqueness

Uniqueness Score: -1.00%

Function 10006BF0 Relevance: 13.6, APIs: 9, Instructions: 111
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E10006BF0(signed char* _a4, signed char* _a8, signed char* _a12) {
				intOrPtr _v1044;
				intOrPtr _v1048;
				char _v1052;
				char _v1056;
				int _v1072;
				int _v1076;
				signed char _v1077;
				int _v1092;
				signed char* _v1096;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t38;
				int _t39;
				int _t42;
				signed int _t63;
				signed char _t66;
				signed char _t70;
				signed char* _t72;
				signed char* _t73;
				signed char* _t74;
				void* _t75;
				signed char** _t76;

				_t64 = 1;
				_t76 = _t75 - 0x43c;
				_v1056 = 0;
				_t73 = _a8;
				_t74 = _a4;
				 *_t76 = _a12;
				_t38 = strlen(??);
				 *_t76 = _t73;
				_v1076 = _t38;
				_t39 = strlen(??);
				_v1092 = 0xffffffff;
				_v1096 = 1;
				_v1072 = _t39;
				 *_t76 =  &_v1052;
				E10008880(1, _t72, _t73, _t74);
				while(1) {
					L1:
					_t66 =  *_t73 & 0x000000ff;
					if(_t66 == 0) {
						goto L13;
					}
					_v1077 = _t66;
					_t72 = _t74;
					do {
						_t63 = _v1077 & 0x000000ff;
						_t64 = 0;
						L5:
						L5:
						if(_t63 - 0x61 <= 0x19) {
							_t63 = _t63 ^ 0x00000020;
						}
						_t70 = _t72[_t64];
						_t66 = _t70;
						if(_t70 - 0x61 <= 0x19) {
							_t66 = _t66 ^ 0x00000020;
						}
						if(_t63 == _t66) {
							goto L4;
						}
						goto L10;
						L4:
						_t64 = _t64 + 1;
						_t63 = _t73[_t64] & 0x000000ff;
						if(_t63 == 0) {
							L15:
							_v1096 = _t74;
							_v1092 = _t72 - _t74;
							 *_t76 =  &_v1052;
							L10008F30();
							_t74 =  &(_t72[_v1072]);
							_v1092 = _v1076;
							_v1096 = _a12;
							 *_t76 =  &_v1052;
							L10008F30();
							goto L1;
						}
						goto L5;
						L10:
						_t72 =  &(_t72[1]);
					} while ( *((char*)(_t72 - 1)) != 0);
					L11:
					 *_t76 = _t74;
					_t42 = strlen(??);
					_v1096 = _t74;
					_v1092 = _t42;
					 *_t76 =  &_v1052;
					L10008F30();
					if(_v1048 < _v1044) {
						_v1096 =  &_v1056;
						 *_t76 =  &_v1052;
						E10009690(_t64, _t66, _t72, _t73);
						return _v1056;
					} else {
						_v1096 = 0;
						 *_t76 =  &_v1052;
						E10009690(_t64, _t66, _t72, _t73);
						return _v1056;
					}
					L13:
					if(_t74 == 0) {
						goto L11;
					}
					_t72 = _t74;
					goto L15;
				}
			}

0x10006bf6
0x10006bfb
0x10006c01
0x10006c0c
0x10006c13
0x10006c1a
0x10006c1d
0x10006c22
0x10006c25
0x10006c29
0x10006c33
0x10006c37
0x10006c3b
0x10006c43
0x10006c46
0x10006c50
0x10006c50
0x10006c50
0x10006c55
0x00000000
0x00000000
0x10006c5b
0x10006c5f
0x10006c70
0x10006c70
0x10006c75
0x00000000
0x10006c89
0x10006c92
0x10006c94
0x10006c94
0x10006c96
0x10006c9a
0x10006ca2
0x10006ca4
0x10006ca4
0x10006ca9
0x00000000
0x00000000
0x00000000
0x10006c80
0x10006c80
0x10006c81
0x10006c87
0x10006d00
0x10006d00
0x10006d08
0x10006d10
0x10006d13
0x10006d1c
0x10006d23
0x10006d2e
0x10006d36
0x10006d39
0x00000000
0x10006d39
0x00000000
0x10006cab
0x10006cab
0x10006cac
0x10006cb2
0x10006cb2
0x10006cb5
0x10006cba
0x10006cbe
0x10006cc6
0x10006cc9
0x10006cd6
0x10006d47
0x10006d4f
0x10006d52
0x10006d65
0x10006cd8
0x10006cda
0x10006ce2
0x10006ce5
0x10006cf8
0x10006cf8
0x10006cf9
0x10006cfb
0x00000000
0x00000000
0x10006cfd
0x00000000
0x10006cfd

APIs

strlen.MSVCRT ref: 10006C1D
strlen.MSVCRT ref: 10006C29
mv_bprint_init.MAIN ref: 10006C46
strlen.MSVCRT ref: 10006CB5
mv_bprint_append_data.MAIN ref: 10006CC9
mv_bprint_finalize.MAIN ref: 10006CE5
mv_bprint_append_data.MAIN ref: 10006D13
mv_bprint_append_data.MAIN ref: 10006D39

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_append_datastrlen$mv_bprint_finalizemv_bprint_init
String ID:
API String ID: 2033710158-0
Opcode ID: 753b12f48858992d8326020eeb6fce0a91498a75255df4ea626593c4d396668a
Instruction ID: baadeae812b352ede2793d16d4d3547ba2ba4a1ad88198903262ae856450ff05
Opcode Fuzzy Hash: 753b12f48858992d8326020eeb6fce0a91498a75255df4ea626593c4d396668a
Instruction Fuzzy Hash: F8414CB49087459FE750DF39C48066BFBE5FF89384F50892EF5D887205DA34AA49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10023249 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

mv_vbprintf.MAIN ref: 1002328D
strcmp.MSVCRT ref: 10023340
strcpy.MSVCRT ref: 10023399
mv_bprint_finalize.MAIN ref: 100234C8
ReleaseSRWLockExclusive.KERNEL32 ref: 100234D4
mv_bprintf.MAIN ref: 10023681

Strings

%s%s%s%s, xrefs: 100232E8
Last message repeated %d times, xrefs: 10023377

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLockReleasemv_bprint_finalizemv_bprintfmv_vbprintfstrcmpstrcpy
String ID: Last message repeated %d times$%s%s%s%s
API String ID: 4275616186-2673086376
Opcode ID: 42d1c28a59b315c23aa48637e9ae167f894d38651270de1a8a98ee9fcc4ad737
Instruction ID: b81f238ef4300ec1d8f16b3a8da4b914aea516d51c501e69078f494d4313df77
Opcode Fuzzy Hash: 42d1c28a59b315c23aa48637e9ae167f894d38651270de1a8a98ee9fcc4ad737
Instruction Fuzzy Hash: E561E4709087958FD720DF24D4803AABBE2FF85384F95885EE8C957342C776E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10028070 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10028099
strtol.MSVCRT ref: 10028143
mv_log.MAIN ref: 1002817E

Strings

none, xrefs: 1002808E
Unable to parse option value "%s" as %s, xrefs: 10028165
Value %d for parameter '%s' out of %s format range [%d - %d], xrefs: 100281B3

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_logstrcmpstrtol
String ID: Unable to parse option value "%s" as %s$Value %d for parameter '%s' out of %s format range [%d - %d]$none
API String ID: 3237617949-2908652078
Opcode ID: 691e268f59eefe45aab27bd49c65c0bfe69c5a44b4361b2dd8b56a23eaf8e8d9
Instruction ID: 4bc733314f34f2699ba82556ed72ea64bb9030a0ec2445b5dd4e85adb85467a1
Opcode Fuzzy Hash: 691e268f59eefe45aab27bd49c65c0bfe69c5a44b4361b2dd8b56a23eaf8e8d9
Instruction Fuzzy Hash: AB3137B4A097458FC344DF78948010AFBE1EFC9390F908A2EF9A9D7391E770D9458B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002D660 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

mv_dict_get.MAIN ref: 1002D6AB
mv_opt_set.MAIN ref: 1002D6CF
mv_log.MAIN ref: 1002D70E
mv_dict_free.MAIN ref: 1002D71A
mv_dict_set.MAIN ref: 1002D74F
mv_dict_free.MAIN ref: 1002D763

Strings

Error setting option %s to value %s., xrefs: 1002D6F7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_free$mv_dict_getmv_dict_setmv_logmv_opt_set
String ID: Error setting option %s to value %s.
API String ID: 3258142065-3279051434
Opcode ID: ef5084decda187cd213080217201cfa49cd5edc4dfbb471ff57d75f3a90a4203
Instruction ID: 35dba755cf83891b6b787024823c04eb56a84bd00f467e741874e99c9612048c
Opcode Fuzzy Hash: ef5084decda187cd213080217201cfa49cd5edc4dfbb471ff57d75f3a90a4203
Instruction Fuzzy Hash: F731A3B9A087449FC740DF69D58065ABBE4FF88294F51882EF99CC7310E674E940DF82

Uniqueness

Uniqueness Score: -1.00%

Function 1004DBC6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1004DB2B
mv_bprintf.MAIN ref: 1004DB5A
mv_bprintf.MAIN ref: 1004DB99
mv_bprintf.MAIN ref: 1004DBB9
mv_bprintf.MAIN ref: 1004DC25
mv_bprintf.MAIN ref: 1004DC52
mv_bprintf.MAIN ref: 1004DC84
mv_bprintf.MAIN ref: 1004DD2D

Strings

%sasm_call, xrefs: 1004DC78
%spreshuf, xrefs: 1004DC43
%sinv_only, xrefs: 1004DC19

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %sasm_call$%sinv_only$%spreshuf
API String ID: 3083893021-3962727239
Opcode ID: cade714074bbf4cdbd1d9e1938e839d1d97dbb16e54fe1d2b698c96d29d33bf8
Instruction ID: 67dafa6c3716fb04da3945efc1cdff4b4d44a551abb565e3f708eab681e72608
Opcode Fuzzy Hash: cade714074bbf4cdbd1d9e1938e839d1d97dbb16e54fe1d2b698c96d29d33bf8
Instruction Fuzzy Hash: D11118B5A08B458BE300FF18D482B5EBAE0FB80694F61882EF4D8D7250D738D941DB86

Uniqueness

Uniqueness Score: -1.00%

Function 1004DCF4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1004DB2B
mv_bprintf.MAIN ref: 1004DB5A
mv_bprintf.MAIN ref: 1004DB99
mv_bprintf.MAIN ref: 1004DBB9
mv_bprintf.MAIN ref: 1004DD2D

Strings

%sfwd_only, xrefs: 1004DB4E
%simdct_full, xrefs: 1004DB8D
%sinplace, xrefs: 1004DB1F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %sfwd_only$%simdct_full$%sinplace
API String ID: 3083893021-1795882851
Opcode ID: 0c426aeb40c8a8c345844a23ba250e7c484747709dc38ef3f37aecba12555ac4
Instruction ID: cf0c403621432339c7d546e34a2f666e9f2b175acd471e126550872e520d6341
Opcode Fuzzy Hash: 0c426aeb40c8a8c345844a23ba250e7c484747709dc38ef3f37aecba12555ac4
Instruction Fuzzy Hash: 5E112DB9A08B458BE300EF18D492B1EBAD0EB84794F25882EF4C8C7251C738DD41C786

Uniqueness

Uniqueness Score: -1.00%

Function 1004DC07 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1004DB99
mv_bprintf.MAIN ref: 1004DBB9
mv_bprintf.MAIN ref: 1004DC25
mv_bprintf.MAIN ref: 1004DC52
mv_bprintf.MAIN ref: 1004DC84

Strings

%sasm_call, xrefs: 1004DC78
%spreshuf, xrefs: 1004DC43
%sinv_only, xrefs: 1004DC19

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %sasm_call$%sinv_only$%spreshuf
API String ID: 3083893021-3962727239
Opcode ID: 1caa6f0ccae62d76709d361e12aa36bb6f9531f3fc4f2277e8a95abe08244352
Instruction ID: 2da4316b6a73a3b0d18d271e3a9328dfff1ea1acd03c322cbe4fbd400d3168d1
Opcode Fuzzy Hash: 1caa6f0ccae62d76709d361e12aa36bb6f9531f3fc4f2277e8a95abe08244352
Instruction Fuzzy Hash: AB011DB9908B44CBE700EF28D492B5EBAD0EB84754F65882EF4C8C7351D7389941C787

Uniqueness

Uniqueness Score: -1.00%

Function 1004A02B Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004A08E
SleepConditionVariableSRW.KERNEL32 ref: 1004A0C6
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A0DC
AcquireSRWLockExclusive.KERNEL32 ref: 1004A123
WakeConditionVariable.KERNEL32 ref: 1004A135
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A141
mv_log.MAIN ref: 1004A1E7
abort.MSVCRT ref: 1004A1EC

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariable$SleepWakeabortmv_log
String ID:
API String ID: 347658250-0
Opcode ID: 5fa1784df7e6f5e9cb7a8772d34de868a2265032091343187e4fb7fffa3ef144
Instruction ID: fe769e6f261b0c0b4b117e343d60818024885dfb85fec5dec2932d96265b7c30
Opcode Fuzzy Hash: 5fa1784df7e6f5e9cb7a8772d34de868a2265032091343187e4fb7fffa3ef144
Instruction Fuzzy Hash: 7B5136B5604B058FD720EF29C58020BFBE1FF89354F118A2DE99A97610E774F949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10002670 Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

mv_samples_get_buffer_size.MAIN ref: 1000269F
mv_mallocz.MAIN ref: 100026B3
mv_sample_fmt_is_planar.MAIN(?), ref: 100026DC
mv_calloc.MAIN(?), ref: 100026F5
mv_fifo_alloc2.MAIN(?), ref: 10002736
mv_fifo_freep2.MAIN(?), ref: 10002761
mv_freep.MAIN(?), ref: 1000276E

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_callocmv_fifo_alloc2mv_fifo_freep2mv_freepmv_malloczmv_sample_fmt_is_planarmv_samples_get_buffer_size
String ID:
API String ID: 3721653357-0
Opcode ID: 42dff5a3eb04adc49f19050df871efb01a7c87c8a448b2921b037ed844c736a9
Instruction ID: bb9eb3e5d0204011adfe0aa4748bc2d8f300a22c96b3cf74cba0d42d24462043
Opcode Fuzzy Hash: 42dff5a3eb04adc49f19050df871efb01a7c87c8a448b2921b037ed844c736a9
Instruction Fuzzy Hash: 273148B8A087068FD700DF69C58061AFBE4FF88384F11892EE99CC7315E774E8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 1001D220 Relevance: 12.1, APIs: 8, Instructions: 71COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1001D230
mv_sha512_alloc.MAIN ref: 1001D273
mv_sha512_alloc.MAIN ref: 1001D2BB
mv_md5_alloc.MAIN ref: 1001D2EB
mv_sha_alloc.MAIN ref: 1001D31B
mv_sha_alloc.MAIN ref: 1001D34B
mv_sha_alloc.MAIN ref: 1001D37B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_sha_alloc$mv_sha512_alloc$mv_malloczmv_md5_alloc
String ID:
API String ID: 1780169607-0
Opcode ID: 89fe73e6439e83052310f9247eaea9b5c1dd9965fdfc5345831e5e410a5014f8
Instruction ID: 308d306f19edf6ed78ffa685c28ceabba911b28968eaf46d4c5fb4499698521b
Opcode Fuzzy Hash: 89fe73e6439e83052310f9247eaea9b5c1dd9965fdfc5345831e5e410a5014f8
Instruction Fuzzy Hash: 543102B0016390CFD740EF50E549B06BBA0FB00315FA6C9A9C50A1F262D7BED944CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 1001FAF0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1001FB71
mv_image_get_linesize.MAIN ref: 1001FD0F
mv_log.MAIN ref: 1001FFA0
abort.MSVCRT ref: 1001FFA5

Strings

av_image_get_linesize failed, xrefs: 1001FEF6
Assertion %s failed at %s:%d, xrefs: 1001FF91

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_image_get_linesizemv_logmv_pix_fmt_desc_get
String ID: Assertion %s failed at %s:%d$av_image_get_linesize failed
API String ID: 1423692287-2525362290
Opcode ID: 19a34fa3045bd52ddc904fabf5880a30275453ed701ec10dc373799bbca6dd21
Instruction ID: eedc48b82a1fb41b1fbcfd9c24b211374ee1d321ec6a1758f6a6c150146530bc
Opcode Fuzzy Hash: 19a34fa3045bd52ddc904fabf5880a30275453ed701ec10dc373799bbca6dd21
Instruction Fuzzy Hash: CDD17C75A08351CFC350CF28C18062AFBE1FF99344F55896DE9898B362D775E982DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1002EC70 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

january, xrefs: 1002ED12
%H:%M:%S, xrefs: 1002EEFB

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %H:%M:%S$january
API String ID: 0-1137272109
Opcode ID: 1c29e17dd7c110d949accdbd1ee5a33e68082553a6f1233e49a09543a94ee517
Instruction ID: deb4ecbef923dd5b9c10f23b947286e4262a05e51063659a656c0b07963a8949
Opcode Fuzzy Hash: 1c29e17dd7c110d949accdbd1ee5a33e68082553a6f1233e49a09543a94ee517
Instruction Fuzzy Hash: CCA193304482978FCB50CF18E4D06A9FBE6FF86340BE548AAD5558F166E731ED46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1004E8A7 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

mv_gcd.MAIN ref: 1004E8FC
mv_malloc.MAIN(?), ref: 1004E9C1
mv_log.MAIN ref: 1004EC52
abort.MSVCRT ref: 1004EC57

Strings

libavutil/tx.c, xrefs: 1004EC33
Assertion %s failed at %s:%d, xrefs: 1004EC45

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_gcdmv_logmv_malloc
String ID: Assertion %s failed at %s:%d$libavutil/tx.c
API String ID: 4069727316-3214517670
Opcode ID: 3a86cab36d8e530dac25bcc30bd8bbdd95ef25ef144ed0f4418dff830d47f98c
Instruction ID: 97686d52ff029028b5cb48a31492680369d7a5b0c0d5c016aae493d3c13362a3
Opcode Fuzzy Hash: 3a86cab36d8e530dac25bcc30bd8bbdd95ef25ef144ed0f4418dff830d47f98c
Instruction Fuzzy Hash: E8B1E375A083818FC764CF29C58065AFBE2FF88314F158A2EE999D7311E730AD45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 1001CA10 Relevance: 10.7, APIs: 7, Instructions: 222COMMON

Download Yara Rule

APIs

mv_adler32_update.MAIN ref: 1001CA46
mv_crc.MAIN ref: 1001CAD5
mv_sha512_final.MAIN ref: 1001CC05
mv_ripemd_final.MAIN ref: 1001CC4D
mv_sha_final.MAIN ref: 1001CCAD
mv_md5_final.MAIN ref: 1001CCFD
mv_murmur3_final.MAIN ref: 1001CD1D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_adler32_updatemv_crcmv_md5_finalmv_murmur3_finalmv_ripemd_finalmv_sha512_finalmv_sha_final
String ID:
API String ID: 1982440126-0
Opcode ID: df96e90217d37244b0dca780f4c69ede17494fb52ea6fc2b56b595ac0794c65b
Instruction ID: 046ab84a8c44898d371c363dc14f1fdf4a4b70b6c38c2771c8d012733aa29193
Opcode Fuzzy Hash: df96e90217d37244b0dca780f4c69ede17494fb52ea6fc2b56b595ac0794c65b
Instruction Fuzzy Hash: E29108B5909746CFC710CF28D18060ABBE0FF89350F65896EE98D9B321D334E985DB96

Uniqueness

Uniqueness Score: -1.00%

Function 1002D910 Relevance: 10.7, APIs: 7, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22194f63cd8b3d32d12af993c9b419f9564881632f182a2152fe54f23c7911b
Instruction ID: 16f5bf25af95bab1faddb375712d4b7f53b5ab5cb691f7174e3ff760a2b83ddc
Opcode Fuzzy Hash: e22194f63cd8b3d32d12af993c9b419f9564881632f182a2152fe54f23c7911b
Instruction Fuzzy Hash: 9B717E75608342CBC755EF28E490A1AB7E1EF94780FA1892EE8D98B355D731DC85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004CAA8 Relevance: 10.7, APIs: 7, Instructions: 151COMMON

Download Yara Rule

APIs

mv_tree_insert.MAIN ref: 1004C57E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13
mv_tree_find.MAIN ref: 1004CBB8
mv_tree_find.MAIN ref: 1004CBD3
mv_tree_find.MAIN ref: 1004CC31
mv_tree_find.MAIN ref: 1004CC48

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find$mv_tree_insert
String ID:
API String ID: 3047205218-0
Opcode ID: 748b1c967ae3881e327b4b3e75e89f36747101333f41ba75464ed4008a113ba7
Instruction ID: 11e2b96d07c673488f848e46a8f9316f5266a218077dcf01b0671550c3d31cb7
Opcode Fuzzy Hash: 748b1c967ae3881e327b4b3e75e89f36747101333f41ba75464ed4008a113ba7
Instruction Fuzzy Hash: 5A51DFB590974A9FC340DF6AC18091AFBE1FF88650F61892EE898C7301E734E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 10020660 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1002067F
mv_image_get_linesize.MAIN ref: 100206B4

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_image_fill_linesizes.MAIN(?), ref: 10020748
mv_image_fill_plane_sizes.MAIN(?), ref: 100207AB

Strings

Picture size %ux%u is invalid, xrefs: 100207FF

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get$mv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_get_linesize
String ID: Picture size %ux%u is invalid
API String ID: 3680373976-1963597007
Opcode ID: 363d7f5b0f2576a8b82a55742b866563a56274ce2c15312feba007e7f86faec8
Instruction ID: 2314817fb5d2ccefc3c8ff58fcc714fc26626ca1613a84a068ef5f43893ec408
Opcode Fuzzy Hash: 363d7f5b0f2576a8b82a55742b866563a56274ce2c15312feba007e7f86faec8
Instruction Fuzzy Hash: C4512576A083418FC354CF69D88564FBBE6EFC8350F558A2EF598C7351EA74E8448B42

Uniqueness

Uniqueness Score: -1.00%

Function 100121A0 Relevance: 10.6, APIs: 7, Instructions: 119COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 1001221F
mv_bprint_init.MAIN ref: 1001225D
mv_bprint_escape.MAIN ref: 100122B3
mv_bprint_append_data.MAIN ref: 100122CC
mv_bprint_escape.MAIN ref: 100122EE
mv_bprint_finalize.MAIN ref: 1001231B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_escape$mv_bprint_append_datamv_bprint_finalizemv_bprint_initmv_strdup
String ID:
API String ID: 806756221-0
Opcode ID: bd899ef9b0dbaba746c8b6d0da506afdd114f8397f9f9c4fb8b0c4949863bb04
Instruction ID: 7187b0243939ecc75a9d4dff51427cd59bf1c299843c139242dac8f39c04a417
Opcode Fuzzy Hash: bd899ef9b0dbaba746c8b6d0da506afdd114f8397f9f9c4fb8b0c4949863bb04
Instruction Fuzzy Hash: 134114B55093449FC360CF28C08029BFBE5FF86354F55892EE9988B341E736EA95CB46

Uniqueness

Uniqueness Score: -1.00%

Function 1000E950 Relevance: 10.6, APIs: 7, Instructions: 113stringCOMMON

Download Yara Rule

APIs

mv_channel_from_string.MAIN ref: 1000E993
strchr.MSVCRT ref: 1000E9C4
mv_strlcpy.MAIN ref: 1000E9EF
mv_channel_from_string.MAIN ref: 1000EA01
strcmp.MSVCRT ref: 1000EA3D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_from_string$mv_strlcpystrchrstrcmp
String ID:
API String ID: 1821482347-0
Opcode ID: da3edf490d4416a14b75eaa0f87995938fed091b4a310eb1baaf614b82469ff7
Instruction ID: b36a671443ebfd3664ebfe81d2672e3825410638c3dff80f38bd050e3f4a86e6
Opcode Fuzzy Hash: da3edf490d4416a14b75eaa0f87995938fed091b4a310eb1baaf614b82469ff7
Instruction Fuzzy Hash: DF418075A087868BEB10DF28C48054EBBE4FF88794F114D2DE8D8A7255D370ED45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001A8BC Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

mv_buffer_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A8CA

Part of subcall function 10009DC0: mv_malloc.MAIN ref: 10009DDC
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009DF2
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009E25

mv_realloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A902

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_mallocz.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A91C
mv_dict_copy.MAIN ref: 1001A996
mv_buffer_ref.MAIN ref: 1001A9EC
mv_realloc.MAIN ref: 1001AA26
mv_mallocz.MAIN ref: 1001AA40
mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AA87
mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AAAD
mv_dict_free.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AAB5
mv_freep.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AABD
mv_freep.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AADB

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_buffer_unrefmv_freepmv_realloc$_aligned_reallocmv_buffer_allocmv_buffer_refmv_dict_copymv_dict_freemv_malloc
String ID:
API String ID: 3654835198-0
Opcode ID: 70dec7b0525f92eea09a52100746da8d68807f2b7a8b1601fe4d47d21b59e6f4
Instruction ID: 2b85b05f5678c247458617f8db437906648f713ae92fec64b70ab4220dcfa18e
Opcode Fuzzy Hash: 70dec7b0525f92eea09a52100746da8d68807f2b7a8b1601fe4d47d21b59e6f4
Instruction Fuzzy Hash: 8F51E674904381CFCB14CF19C58069ABBE1FF89390F46896EE98A9B351E770E981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10006940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10006950
mv_malloc.MAIN ref: 10006959
strspn.MSVCRT ref: 10006980
strspn.MSVCRT ref: 100069C1

Strings

, xrefs: 10006973, 10006A73

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strspn$mv_mallocstrlen
String ID:
API String ID: 1916163187-596783616
Opcode ID: c1cd0ea710ee61caf6f581c2a68d6a1753dc280333e09f0715da0c84ddb40841
Instruction ID: 4177569fa848450c707169e52794d897aa5a5a3714551b1bd9b9763f873ecb90
Opcode Fuzzy Hash: c1cd0ea710ee61caf6f581c2a68d6a1753dc280333e09f0715da0c84ddb40841
Instruction Fuzzy Hash: E341847460C3958FDB11DF25888025ABBE7EF8B6C0F55885DE8C56B306C235EA48CB93

Uniqueness

Uniqueness Score: -1.00%

Function 1002C706 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

mv_expr_parse_and_eval.MAIN ref: 1002C5F5

Strings

none, xrefs: 1002C54A
max, xrefs: 1002C505
default, xrefs: 1002C4D2
min, xrefs: 1002C51F
all, xrefs: 1002C56F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_parse_and_eval
String ID: all$default$max$min$none
API String ID: 2217327432-3292705889
Opcode ID: e2d7b0edeec2b1870f040b64e547b800b90d05965a24d8d30024c1e278e1b004
Instruction ID: 83d07ffb6d8c6cfe48df1192a88470446e278d9b2bcb376e76410f15be41486f
Opcode Fuzzy Hash: e2d7b0edeec2b1870f040b64e547b800b90d05965a24d8d30024c1e278e1b004
Instruction Fuzzy Hash: A6410475A097458BC395EF28E04038BBBE5FFC9314F618A2EE9C9D7200EB71D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002931B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 100292C3
mv_log.MAIN ref: 100292ED
mv_log.MAIN ref: 10029355
mv_log.MAIN ref: 10029373
mv_log.MAIN ref: 10029391

Strings

%-15s , xrefs: 100292D4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$strcmp
String ID: %-15s
API String ID: 1163046698-755444208
Opcode ID: 8817496acbf438144a82c63c68a2b26bf455b6893397366e45a129ce34d41058
Instruction ID: c2e3231857e14b6d66286021a66802d314ea6e9fac30e20b35dba61e0b599c78
Opcode Fuzzy Hash: 8817496acbf438144a82c63c68a2b26bf455b6893397366e45a129ce34d41058
Instruction Fuzzy Hash: 39319E78A093459FC750DF28E19065EBBE1EF88B80F91C82EF89987351E774E9409B42

Uniqueness

Uniqueness Score: -1.00%

Function 1008F820 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1008F832
_errno.MSVCRT ref: 1008F850
rand.MSVCRT ref: 1008F8B0
_sopen.MSVCRT ref: 1008F8F6
_errno.MSVCRT ref: 1008F904

Strings

XXXX, xrefs: 1008F848

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$_sopenrandstrlen
String ID: XXXX
API String ID: 1081397658-1518373315
Opcode ID: 41818ad3e72adebc80571ed86afad46c9302ef0646f7f912c4873975d3c77747
Instruction ID: 44b3c0712c4d6cf3a6541ef21b7e2c07706476ce399c25bdb07493ab5c095def
Opcode Fuzzy Hash: 41818ad3e72adebc80571ed86afad46c9302ef0646f7f912c4873975d3c77747
Instruction Fuzzy Hash: CA21F571D0834ACFC318EF35889416A7BE0FF8A354F12892FE6548B291DF319949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1004ADA2 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004ADC1
SleepConditionVariableSRW.KERNEL32 ref: 1004AE06
mv_fifo_can_write.MAIN ref: 1004AE17
mv_fifo_write.MAIN ref: 1004AE45
WakeConditionVariable.KERNEL32 ref: 1004AE4D
ReleaseSRWLockExclusive.KERNEL32 ref: 1004AE61
mv_fifo_can_write.MAIN ref: 1004AE7A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ConditionExclusiveLockVariablemv_fifo_can_write$AcquireReleaseSleepWakemv_fifo_write
String ID:
API String ID: 1714568982-0
Opcode ID: 59fc24529d47b532e66b5b3831bd231c189a45747d7c0a66f772760b2b6236a2
Instruction ID: ec709376b0b89c78eb46bbda5f47f05697af6bd00d4b2580ac78c3a99c1943e1
Opcode Fuzzy Hash: 59fc24529d47b532e66b5b3831bd231c189a45747d7c0a66f772760b2b6236a2
Instruction Fuzzy Hash: E3216B759047059FCB00EF2AD58461BBBF1FF85354F11896DEDA88B259E730E886CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1009FCE0 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 1009EC40: TlsGetValue.KERNEL32 ref: 1009EE50

longjmp.MSVCRT ref: 1009FD16
TlsGetValue.KERNEL32(?,?,?,0000001C,1009FECF,?,?,?,?,00000000,100A000E,?,?,?,00000000,?), ref: 1009FD24
CloseHandle.KERNEL32(?,?,?,?,0000001C,1009FECF,?,?,?,?,00000000,100A000E,?,?,?,00000000), ref: 1009FD4B
_endthreadex.MSVCRT(?,?,?,?,0000001C,1009FECF,?,?,?,?,00000000,100A000E,?,?,?,00000000), ref: 1009FD60
CloseHandle.KERNEL32(?,?,?,?,0000001C,1009FECF,?,?,?,?,00000000,100A000E,?,?,?,00000000), ref: 1009FD72
TlsSetValue.KERNEL32(?,?,?,?,?,0000001C,1009FECF,?,?,?,?,00000000,100A000E), ref: 1009FD93
CloseHandle.KERNEL32(?,?,?,?,0000001C,1009FECF,?,?,?,?,00000000,100A000E,?,?,?,00000000), ref: 1009FDAA

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 1e59f70c80adffc8647815539189789f521a4a1feb645c286b5d2cdfa007b9e6
Instruction ID: 962cc8520e881451eea878f9a5084871f4b07051aabbe8c2d8c5f2e408e110ad
Opcode Fuzzy Hash: 1e59f70c80adffc8647815539189789f521a4a1feb645c286b5d2cdfa007b9e6
Instruction Fuzzy Hash: 3621C7B45063119FDB40EF34C98862A7BE5FB08344F06486DED88CB25AE734D840DB92

Uniqueness

Uniqueness Score: -1.00%

Function 1000F8F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1000F8F7
GetProcessAffinityMask.KERNEL32 ref: 1000F910
mv_log.MAIN ref: 1000F99A

Strings

overriding to %d logical cores, xrefs: 1000F981
detected %d logical cores, xrefs: 1000F9B4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Process$AffinityCurrentMaskmv_log
String ID: detected %d logical cores$overriding to %d logical cores
API String ID: 4261380130-3421371979
Opcode ID: c659c9415a9862b172ccff880677a34c8f56de918c1cf1742d91ff05b19fa797
Instruction ID: 58e6b2fe0b08649328af5215a9cec38f6754a0f8dc443d6bf54cb1b14bc42e03
Opcode Fuzzy Hash: c659c9415a9862b172ccff880677a34c8f56de918c1cf1742d91ff05b19fa797
Instruction Fuzzy Hash: E82130B5A197019BD304DF29C48131ABBE2EBC8350F48C93DF989C7759E638D9458B43

Uniqueness

Uniqueness Score: -1.00%

Function 1001D7A0 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

mv_buffer_pool_uninit.MAIN ref: 1001D7BB

Part of subcall function 1000A650: AcquireSRWLockExclusive.KERNEL32 ref: 1000A66C
Part of subcall function 1000A650: mv_freep.MAIN ref: 1000A69C
Part of subcall function 1000A650: ReleaseSRWLockExclusive.KERNEL32 ref: 1000A6AB

mv_buffer_unref.MAIN ref: 1001D7F2
mv_buffer_unref.MAIN ref: 1001D801
mv_freep.MAIN ref: 1001D810
mv_freep.MAIN ref: 1001D822
mv_freep.MAIN ref: 1001D831
mv_freep.MAIN ref: 1001D83D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$ExclusiveLockmv_buffer_unref$AcquireReleasemv_buffer_pool_uninit
String ID:
API String ID: 3286761627-0
Opcode ID: c6c09d7d300876a1707853c3afdde09c35c9359a08c94a7bfa9ac57c73ae979d
Instruction ID: d019eb9eba46684987302df58934bd10d6a5c0a39701eb176e19b0f551cd46b2
Opcode Fuzzy Hash: c6c09d7d300876a1707853c3afdde09c35c9359a08c94a7bfa9ac57c73ae979d
Instruction Fuzzy Hash: FE1198B86087018FDB04EF69D485A1EFBE1FF84204F46895DE4948B306E735E889CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1000C220 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000C27B
mv_bprintf.MAIN ref: 1000C298
mv_bprintf.MAIN ref: 1000C2B8

Strings

AMBI%d, xrefs: 1000C2AC
USR%d, xrefs: 1000C28C
NONE, xrefs: 1000C247

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: AMBI%d$NONE$USR%d
API String ID: 3083893021-3656852315
Opcode ID: 6cd4f19d3d74ee3d12c501f26348e63cdefaf32e071506f7e6661ce223037e5e
Instruction ID: 7fcf34f7b534e12bd35e409064aa58f3f25e521088902b3bc772a385e2e8df73
Opcode Fuzzy Hash: 6cd4f19d3d74ee3d12c501f26348e63cdefaf32e071506f7e6661ce223037e5e
Instruction Fuzzy Hash: FA0121B4909B85CBD344EF68848052DB6E1FB94384F948A6DE4CC87755E639DE409B83

Uniqueness

Uniqueness Score: -1.00%

Function 1000C3C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000C41B
mv_bprintf.MAIN ref: 1000C438
mv_bprintf.MAIN ref: 1000C458

Strings

ambisonic ACN %d, xrefs: 1000C44C
none, xrefs: 1000C3E7
user %d, xrefs: 1000C42C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: ambisonic ACN %d$none$user %d
API String ID: 3083893021-4180635230
Opcode ID: 223aa0a192477accd332f19378ca7d36c64ee90d24a02cbd76f3be9b95891286
Instruction ID: dcc63c4345791cf420d4df1e5b10cc0e469fa513568dbd2a0042959f5c7c7fdf
Opcode Fuzzy Hash: 223aa0a192477accd332f19378ca7d36c64ee90d24a02cbd76f3be9b95891286
Instruction Fuzzy Hash: D7011EB4908B81CBD314EF28908152DBAE1FBD4284F94896DE4CC87355E639DA408B53

Uniqueness

Uniqueness Score: -1.00%

Function 1001B039 Relevance: 9.2, APIs: 6, Instructions: 164COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1001B043
mv_image_check_size.MAIN ref: 1001B069

Part of subcall function 1001F6A0: mv_image_get_linesize.MAIN ref: 1001F6E3

mv_image_fill_linesizes.MAIN ref: 1001B0C8

Part of subcall function 1001EAB0: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6

mv_image_fill_plane_sizes.MAIN ref: 1001B15D
mv_buffer_alloc.MAIN ref: 1001B1CD
mv_image_fill_pointers.MAIN ref: 1001B1FC

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get$mv_buffer_allocmv_image_check_sizemv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_fill_pointersmv_image_get_linesize
String ID:
API String ID: 566543421-0
Opcode ID: f91591d019d291e180dcf44e96ce89918f7d927db6cfc3ba89d5ff0d6a58ef0d
Instruction ID: a5d1a7900a1a2f35fa09734171263621add282bd6d5ab2c0dd3880a3946380f0
Opcode Fuzzy Hash: f91591d019d291e180dcf44e96ce89918f7d927db6cfc3ba89d5ff0d6a58ef0d
Instruction Fuzzy Hash: 8A61F7B5A08B018FCB44DF69C59065ABBE1FF88240F16897DE949CB319E735E884CF41

Uniqueness

Uniqueness Score: -1.00%

Function 1003A4F0 Relevance: 9.2, APIs: 6, Instructions: 164COMMON

Download Yara Rule

APIs

mv_calloc.MAIN ref: 1003A52A
mv_samples_get_buffer_size.MAIN ref: 1003A55E
mv_malloc.MAIN ref: 1003A572
mv_samples_fill_arrays.MAIN ref: 1003A5A8

Part of subcall function 1003A1B0: mv_samples_get_buffer_size.MAIN ref: 1003A201

mv_freep.MAIN ref: 1003A697

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_samples_get_buffer_size$mv_callocmv_freepmv_mallocmv_samples_fill_arrays
String ID:
API String ID: 3785048109-0
Opcode ID: 5ae1779f3f7e2cdb2b331e1be93d4aeac89c33ba1fb156b6b974ba19d1fc6e91
Instruction ID: bcd7097c64c988b962d1b439634854989dd960b0eefa7e233943bcd087631235
Opcode Fuzzy Hash: 5ae1779f3f7e2cdb2b331e1be93d4aeac89c33ba1fb156b6b974ba19d1fc6e91
Instruction Fuzzy Hash: E3518E75E087418FC701CF69D4C160AFBE4EF86395F56492EE8848B360E375E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1002C140 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002C201
strcmp.MSVCRT ref: 1002C21F
strcmp.MSVCRT ref: 1002C249
mv_opt_find2.MAIN ref: 1002C323

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_opt_find2
String ID:
API String ID: 3181049271-0
Opcode ID: 04fd4d9bdf331594b408d4ec8202b0f2e6e9772fccb4101c97f8bf67926a7e0f
Instruction ID: 5aa1348898b91abb05038d254fdb3b78ff7920596d5d7f99927f5e0623b01fd6
Opcode Fuzzy Hash: 04fd4d9bdf331594b408d4ec8202b0f2e6e9772fccb4101c97f8bf67926a7e0f
Instruction Fuzzy Hash: 1441C57460834DCBCB50DEE5A580A5BB7E4EF857C4F85882DEC9887211EB74EC49DB81

Uniqueness

Uniqueness Score: -1.00%

Function 1001C210 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

mv_buffer_is_writable.MAIN ref: 1001C24C
mv_buffer_is_writable.MAIN ref: 1001C27C
mv_channel_layout_copy.MAIN ref: 1001C30C
mv_hwframe_get_buffer.MAIN ref: 1001C336
mv_frame_copy.MAIN ref: 1001C348

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_is_writable$mv_channel_layout_copymv_frame_copymv_hwframe_get_buffer
String ID:
API String ID: 1431812533-0
Opcode ID: 364bd59554279b40aee4642812e1f726182608b2a75209079b3376af4345f371
Instruction ID: eaf454bc14f92c14001bd62492fec0c564a2a00f258074e35efd3c86292710f4
Opcode Fuzzy Hash: 364bd59554279b40aee4642812e1f726182608b2a75209079b3376af4345f371
Instruction Fuzzy Hash: 46514B75A047168BD354CF79C880B9AF7E4FF88350F018A2AE999CB301E734E8948B91

Uniqueness

Uniqueness Score: -1.00%

Function 1008E250 Relevance: 9.1, APIs: 6, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 1008E27F
vfprintf.MSVCRT ref: 1008E29F
abort.MSVCRT ref: 1008E2A4
VirtualQuery.KERNEL32 ref: 1008E33B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID:
API String ID: 2513968241-0
Opcode ID: 77f9c74a023bead4244158e4538434e8ac340feeaea4348980fb076ccdbc421e
Instruction ID: 54ad2b6e83e5b16b79a45a6593ed35e006b5b48100f64ca54a0057f1c503df76
Opcode Fuzzy Hash: 77f9c74a023bead4244158e4538434e8ac340feeaea4348980fb076ccdbc421e
Instruction Fuzzy Hash: E0514BB59053519FC700EF68C98965AFBE4FF84354F42C92EE8988B226D734E944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10001020 Relevance: 9.1, APIs: 6, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,10001281,?,?,?,?,?,?,100013AE), ref: 10001057
_amsg_exit.MSVCRT ref: 10001086

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: d59ae3628b0237ba56fdd7c9d317007903976593300e79648f20ecf33c672c95
Instruction ID: dd64dd1eda1eb68cef0d792f916db726e673d7e5cc478cdb0012762ac5c84acb
Opcode Fuzzy Hash: d59ae3628b0237ba56fdd7c9d317007903976593300e79648f20ecf33c672c95
Instruction Fuzzy Hash: 1A31A374609651CBE310EF54C9C438A7BE1FB483C0F52482DE9848B76DD7B9D884DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004A200 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004A262
WakeConditionVariable.KERNEL32 ref: 1004A274
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A280
WaitForSingleObjectEx.KERNEL32 ref: 1004A2C8
CloseHandle.KERNEL32 ref: 1004A2D8
mv_freep.MAIN ref: 1004A2F3

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseConditionHandleObjectReleaseSingleVariableWaitWakemv_freep
String ID:
API String ID: 1841216690-0
Opcode ID: 18bc572b1c8a2e61cb34bfd6f4b1ef9c865d202ec6cb55ee2b061ed66f55e34f
Instruction ID: 3180a2c82765ffdb0d0e9836089f8425691ac15bb4143a1306c626e3471b16ad
Opcode Fuzzy Hash: 18bc572b1c8a2e61cb34bfd6f4b1ef9c865d202ec6cb55ee2b061ed66f55e34f
Instruction Fuzzy Hash: 34317EB26047058FD304EF68D98420BBBE1FF85290F61853DE85987205E331E999CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 1000E173 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1000DF70
mv_channel_layout_from_mask.MAIN ref: 1000E046
mv_freep.MAIN ref: 1000E17B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_from_maskmv_freepstrcmp
String ID:
API String ID: 3576703362-0
Opcode ID: 2b02768f874b8c8628ca8c24d3a244cf9eff547c0ef362d73473bb9b13f20ec1
Instruction ID: 3232a43fc97f47c23ab915f7ee9f6b07ea90700946469634bd9b1ff3e7b05c00
Opcode Fuzzy Hash: 2b02768f874b8c8628ca8c24d3a244cf9eff547c0ef362d73473bb9b13f20ec1
Instruction Fuzzy Hash: 9C313871A087819FE340DF25D48061EBBE1EF88394F52982EF98997318DB71EC44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1004A30C Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004A262
WakeConditionVariable.KERNEL32 ref: 1004A274
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A280
WaitForSingleObjectEx.KERNEL32 ref: 1004A2C8
CloseHandle.KERNEL32 ref: 1004A2D8
mv_freep.MAIN ref: 1004A2F3

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseConditionHandleObjectReleaseSingleVariableWaitWakemv_freep
String ID:
API String ID: 1841216690-0
Opcode ID: a14856d7447140d92799d6568a2db05317804891632b94121e1a719d57eb44ae
Instruction ID: bc251ce03876973850fb77e440ae180f66f2e7fe9fc8712012c25621f5453433
Opcode Fuzzy Hash: a14856d7447140d92799d6568a2db05317804891632b94121e1a719d57eb44ae
Instruction Fuzzy Hash: BF214CB15087158FC700EF68D98420EBBE0FF94340F61853DE89997215D331E599CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 1004ABE0 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1004AC0F
InitializeConditionVariable.KERNEL32 ref: 1004AC20
InitializeConditionVariable.KERNEL32 ref: 1004AC35
InitializeConditionVariable.KERNEL32 ref: 1004AC40
mv_fifo_alloc2.MAIN ref: 1004AC52

Part of subcall function 10017E40: mv_mallocz.MAIN(?,?,?,?,?,1000273B,?), ref: 10017E68

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ConditionInitializeVariable$mv_mallocz$mv_fifo_alloc2
String ID:
API String ID: 4159095404-0
Opcode ID: 68ed5958712f8b9247d161368677f2373c9bee7be8b24f4aba2edd28cfc7c0bd
Instruction ID: 77c5a22245ff2ea0d9598cbb66c79e25fd2b4f41ce900f053c79d3e9a8a37389
Opcode Fuzzy Hash: 68ed5958712f8b9247d161368677f2373c9bee7be8b24f4aba2edd28cfc7c0bd
Instruction Fuzzy Hash: 1411F3B49087508FCB40EF39C4C501ABBE0BF88224F554A6DE898D7355E734E984CB87

Uniqueness

Uniqueness Score: -1.00%

Function 10022D61 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 10022D6F
GetStdHandle.KERNEL32 ref: 10022D7D
GetConsoleMode.KERNEL32 ref: 10022D9B
GetConsoleScreenBufferInfo.KERNEL32 ref: 10022DC1
getenv.MSVCRT ref: 10022DE7
getenv.MSVCRT ref: 10022E04

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: getenv$Console$BufferHandleInfoModeScreen
String ID:
API String ID: 1699668291-0
Opcode ID: 20a079de1c84d2c6add4b7781bd387741d9771386b4c65c5693b4aa4e575faf6
Instruction ID: fe02dfaf5a56e24e13bb8174e1cc7c51f089ad00ab628983cca4ffc4e16b873f
Opcode Fuzzy Hash: 20a079de1c84d2c6add4b7781bd387741d9771386b4c65c5693b4aa4e575faf6
Instruction Fuzzy Hash: 93115CB45043519BD700EF68C98412ABBE0FB44351FD24A2DEC90873A0E735D844EBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1004ACAC Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004ACD3
mv_fifo_can_read.MAIN ref: 1004ACE0
mv_fifo_read_to_cb.MAIN ref: 1004AD0A
WakeAllConditionVariable.KERNEL32 ref: 1004AD15
ReleaseSRWLockExclusive.KERNEL32 ref: 1004AD21
mv_fifo_freep2.MAIN ref: 1004AD2E

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWakemv_fifo_can_readmv_fifo_freep2mv_fifo_read_to_cb
String ID:
API String ID: 615083901-0
Opcode ID: f908e11577fa9e9f27df5fae08cb340458eb94c1e5e0980e4a5beade5a6b1dd7
Instruction ID: 53bc401033f2b2a0ebf3b5c2ccc448d0070cda8b95e7b930312724574dc66f6b
Opcode Fuzzy Hash: f908e11577fa9e9f27df5fae08cb340458eb94c1e5e0980e4a5beade5a6b1dd7
Instruction Fuzzy Hash: 1411B0B59087408FCB00EF69C08501ABBE0FF88204F55896EE8C8AB305D734EA85CF83

Uniqueness

Uniqueness Score: -1.00%

Function 1001DA67 Relevance: 9.0, APIs: 6, Instructions: 40COMMON

Download Yara Rule

APIs

mv_buffer_ref.MAIN ref: 1001D9F6
mv_buffer_create.MAIN ref: 1001DA2F
mv_mallocz.MAIN ref: 1001DA73
mv_buffer_unref.MAIN ref: 1001DA99

Part of subcall function 1000A000: mv_freep.MAIN ref: 1000A01E

mv_freep.MAIN ref: 1001DAAF
mv_freep.MAIN ref: 1001DABE
mv_freep.MAIN ref: 1001DACD
mv_freep.MAIN ref: 1001DAD9

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unrefmv_mallocz
String ID:
API String ID: 3470597486-0
Opcode ID: 82d4d6f48f5693230cace15fd24bc2228de7c8f31a461438f864d3093ed9a926
Instruction ID: 5b75efe8a7b385c844e612e13115847a546b552e435f503cc794a769bad89dbf
Opcode Fuzzy Hash: 82d4d6f48f5693230cace15fd24bc2228de7c8f31a461438f864d3093ed9a926
Instruction Fuzzy Hash: 4101A8756097909FDB40EF74D88161EBBE4EF44294F811C2EF985CB316E735E4848B42

Uniqueness

Uniqueness Score: -1.00%

Function 10011B29 Relevance: 9.0, APIs: 6, Instructions: 27COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10011AE6
mv_freep.MAIN ref: 10011AF2
mv_freep.MAIN ref: 10011B36
mv_freep.MAIN ref: 10011B42

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 040eb387164af77af1c63a09622b6d2a53c8259c3461063de0c689219d215f94
Instruction ID: 1079961fa057578bb5c831cca7ccaeae819dd5d2bf26a49409838597a67f0fd3
Opcode Fuzzy Hash: 040eb387164af77af1c63a09622b6d2a53c8259c3461063de0c689219d215f94
Instruction Fuzzy Hash: ABF0F879509B548BCB00EFB4E88559DBBE4FF48214F810C2EF8C487305F635E5448B42

Uniqueness

Uniqueness Score: -1.00%

Function 100304E8 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

APIs

mv_strstart.MAIN ref: 1002FCB5
mv_strstart.MAIN ref: 1002FCDE

Strings

xyz, xrefs: 1002FCD5
yuvj, xrefs: 1002FCA4
, xrefs: 10030012

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strstart
String ID: $xyz$yuvj
API String ID: 2201124280-2071466796
Opcode ID: bd39db4a194a366d109f30458d461c2df5a62078d964f913814af86215653bba
Instruction ID: fae87543b31ee3dab4fff42b62755004a6e6770c78894ec516081f8316d78002
Opcode Fuzzy Hash: bd39db4a194a366d109f30458d461c2df5a62078d964f913814af86215653bba
Instruction Fuzzy Hash: 28C1F3355083948FD342CF28D8D47AABBE2EFC6388F85496CF4D187266D275DA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1003028C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

mv_strstart.MAIN ref: 1002FCB5
mv_strstart.MAIN ref: 1002FCDE

Strings

xyz, xrefs: 1002FCD5
yuvj, xrefs: 1002FCA4
, xrefs: 10030012

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strstart
String ID: $xyz$yuvj
API String ID: 2201124280-2071466796
Opcode ID: 81723ec4f1f1f9ea585c3b123fc44b8cc6761d75b4754926e1d488a3831eaf29
Instruction ID: bfc651eaba2522c4d235aec60645e24123cb0f9c5bb9b4cc4e7f011c1b04411b
Opcode Fuzzy Hash: 81723ec4f1f1f9ea585c3b123fc44b8cc6761d75b4754926e1d488a3831eaf29
Instruction Fuzzy Hash: 02C103355083948FD342CF28D8D47AABBE2EFC5388F85496CF4D187266D275EA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002FC5C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 274COMMON

Download Yara Rule

APIs

mv_strstart.MAIN ref: 1002FCB5
mv_strstart.MAIN ref: 1002FCDE

Strings

xyz, xrefs: 1002FCD5
yuvj, xrefs: 1002FCA4
, xrefs: 10030012

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strstart
String ID: $xyz$yuvj
API String ID: 2201124280-2071466796
Opcode ID: 831736c8ad5be996d1d974f52483d6687adadd47be56ba45a0c012d7209c2533
Instruction ID: 6866eada51ffeccb3bcd79017aa5c0f6fa0d863f499d88c8390e7ea63e4d7b85
Opcode Fuzzy Hash: 831736c8ad5be996d1d974f52483d6687adadd47be56ba45a0c012d7209c2533
Instruction Fuzzy Hash: 54B104355083948FD342CF28D8D47AABBE2EFC5388F85496CF4D187266D274EA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 10029C83 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 10029E48

Strings

Value %f for parameter '%s' out of range [%g - %g], xrefs: 10029E73
Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 10029E35

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
API String ID: 2835281190-116802341
Opcode ID: 85b4fc1aec8ce736f54b21af87b4db9dd5f991eeb2f13173ab31ba0420f940e4
Instruction ID: 6cb00672ed6c8f4910acef66abedeeb27651edc44efdcdefd04527b42cc9b41a
Opcode Fuzzy Hash: 85b4fc1aec8ce736f54b21af87b4db9dd5f991eeb2f13173ab31ba0420f940e4
Instruction Fuzzy Hash: 14914B7580CB458FD7A0DF24E88024AB7E0FF8A790FA19B1DF8D597251EB3194819742

Uniqueness

Uniqueness Score: -1.00%

Function 1001F550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

mv_image_get_linesize.MAIN ref: 1001F5A7

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_log.MAIN ref: 1001F651
mv_log.MAIN(?), ref: 1001F68E

Strings

Picture size %ux%u exceeds specified max pixel count %lld, see the documentation if you wish to increase it, xrefs: 1001F67E
Picture size %ux%u is invalid, xrefs: 1001F634

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_image_get_linesizemv_pix_fmt_desc_get
String ID: Picture size %ux%u exceeds specified max pixel count %lld, see the documentation if you wish to increase it$Picture size %ux%u is invalid
API String ID: 1737039923-91635712
Opcode ID: b713d412f0b4c193ddf67d660aae77bfb9a187d1b155d626092247ac1b9e9bef
Instruction ID: b6506859fe761d8d1ebdf93eb357839b8b21828a19d49b356052a9795fea712b
Opcode Fuzzy Hash: b713d412f0b4c193ddf67d660aae77bfb9a187d1b155d626092247ac1b9e9bef
Instruction Fuzzy Hash: FA41DFB5A083449FC350CF29C08020EFBE1FBD8750F558A2EF9A8D7360E674E9458B86

Uniqueness

Uniqueness Score: -1.00%

Function 1000C560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 1000C582
strcmp.MSVCRT ref: 1000C5B0
strtol.MSVCRT ref: 1000C5DA

Strings

AMBI, xrefs: 1000C561

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmpstrncmpstrtol
String ID: AMBI
API String ID: 155133989-3084986980
Opcode ID: c65f3f7975b7823a73d044f094c93d5fd796e748c7aa11a49156733d133437d6
Instruction ID: 96a3e84c180ec1e05a7f5708790a2991e0ec9e313a24bbe51d35f59fb7ac403f
Opcode Fuzzy Hash: c65f3f7975b7823a73d044f094c93d5fd796e748c7aa11a49156733d133437d6
Instruction Fuzzy Hash: B6217FB590C7864FE750DF249CC060BBAD0EF492D1F11893EE98993255E275DC85C782

Uniqueness

Uniqueness Score: -1.00%

Function 1002C02C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strspn.MSVCRT ref: 1002BF97
strchr.MSVCRT ref: 1002BFB5
mv_malloc.MAIN(?,?,?,?,?,?,?,?,?,?,100AEACF,100AEB86,00000000,?,1000DF13), ref: 1002BFCD
mv_get_token.MAIN ref: 1002BFFF

Strings

, xrefs: 1002BF8E

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_tokenmv_mallocstrchrstrspn
String ID:
API String ID: 476366593-596783616
Opcode ID: 29e496927f1da63fb82fa8c860c72426edcc2de4f9f69176329bf0e8f31cb9b9
Instruction ID: dc3b06df85388a75f907743202ecfe3307d48378777e578708470cdae6669aaf
Opcode Fuzzy Hash: 29e496927f1da63fb82fa8c860c72426edcc2de4f9f69176329bf0e8f31cb9b9
Instruction Fuzzy Hash: 89215E745087458FCB00DFB8D5C095ABBE5FF89284F80896ED998C7301E675E84ADB42

Uniqueness

Uniqueness Score: -1.00%

Function 10012370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strftime.MSVCRT ref: 100123EF
mv_strlcatf.MAIN ref: 10012429
mv_dict_set.MAIN ref: 1001244D

Strings

.%06dZ, xrefs: 10012419
%Y-%m-%dT%H:%M:%S, xrefs: 100123D6

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_setmv_strlcatfstrftime
String ID: %Y-%m-%dT%H:%M:%S$.%06dZ
API String ID: 3046200060-930656424
Opcode ID: 728a3bd6f1d20a34548cbc8e6d3f3df844403d6c227aa6eea2e28321bcd2af87
Instruction ID: 1402893b187d2e51f9b144a86c1e9403a14236be66f1ea1af33c468999098a96
Opcode Fuzzy Hash: 728a3bd6f1d20a34548cbc8e6d3f3df844403d6c227aa6eea2e28321bcd2af87
Instruction Fuzzy Hash: 982190B59093419FD350DF29E58065BBBE0FB88354F51C92EF89CC7305E639D8948B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000D5CB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000D617
mv_bprintf.MAIN ref: 1000D64E
mv_bprintf.MAIN ref: 1000D678
mv_bprintf.MAIN ref: 1000D715
mv_bprintf.MAIN ref: 1000D7EB
mv_bprintf.MAIN ref: 1000D814
mv_bprintf.MAIN ref: 1000D84A
mv_bprintf.MAIN ref: 1000D86F
mv_bprintf.MAIN ref: 1000D8CE

Strings

@%s, xrefs: 1000D642
NONE, xrefs: 1000D60B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: @%s$NONE
API String ID: 3083893021-9228147
Opcode ID: 79dbcbfc88ece960a6534e3f0ca092c78e639d7c6172cd214de36e0c89aebf28
Instruction ID: 70331aafde610822ed2af80890897691dd53c5944589bad81a8dad7e52305c51
Opcode Fuzzy Hash: 79dbcbfc88ece960a6534e3f0ca092c78e639d7c6172cd214de36e0c89aebf28
Instruction Fuzzy Hash: 65114C71909B5A8BE720EF18C58016EF7E1FB443D4F55881EE889A7219D731EC94CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1004DD77 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1004DB5A
mv_bprintf.MAIN ref: 1004DB99
mv_bprintf.MAIN ref: 1004DBB9
mv_bprintf.MAIN ref: 1004DC25
mv_bprintf.MAIN ref: 1004DC52
mv_bprintf.MAIN ref: 1004DC84

Strings

%sfwd_only, xrefs: 1004DB4E
%simdct_full, xrefs: 1004DB8D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %sfwd_only$%simdct_full
API String ID: 3083893021-2621051289
Opcode ID: 9fff96db5db42393d71e82ebfda62a13665cedb92ba42fd9390b3413d9b8f53e
Instruction ID: 4f6aa12795d5e38d28d0edd5e70445738a48c94f9c8b04c441468997cd072d01
Opcode Fuzzy Hash: 9fff96db5db42393d71e82ebfda62a13665cedb92ba42fd9390b3413d9b8f53e
Instruction Fuzzy Hash: 0BF03CB6A046458AE300EF18D482B1EBAD0EB80754F25882EE4C8C7201C77899418746

Uniqueness

Uniqueness Score: -1.00%

Function 1002CD13 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002CD28
mv_parse_video_size.MAIN ref: 1002D046
mv_log.MAIN ref: 1002D072

Strings

Unable to parse option value "%s" as image size, xrefs: 1002D059
none, xrefs: 1002CD1F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_logmv_parse_video_sizestrcmp
String ID: Unable to parse option value "%s" as image size$none
API String ID: 349907703-3024956746
Opcode ID: 8e9b74a56ba90b3e49ed514bed5e5ddb6f35c082bd033cfe3fc6b3de8838855b
Instruction ID: 25b06a03ed28cd132a7896583b9fec0deb663299f1d12d63675690ddd4282c1e
Opcode Fuzzy Hash: 8e9b74a56ba90b3e49ed514bed5e5ddb6f35c082bd033cfe3fc6b3de8838855b
Instruction Fuzzy Hash: 2C01E8B95087499FD310DF58D14061AFBE4FF89780FA18C2EE98897710E774E8459F42

Uniqueness

Uniqueness Score: -1.00%

Function 100199F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 1008F820: strlen.MSVCRT ref: 1008F832
Part of subcall function 1008F820: _errno.MSVCRT ref: 1008F850

_errno.MSVCRT ref: 10019A21
mv_log.MAIN ref: 10019A4E
mv_freep.MAIN ref: 10019A56

Strings

./%sXXXXXX, xrefs: 100199FC
ff_tempfile: Cannot open temporary file %s, xrefs: 10019A45

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$mv_freepmv_logstrlen
String ID: ./%sXXXXXX$ff_tempfile: Cannot open temporary file %s
API String ID: 3408331932-3725816632
Opcode ID: a3950751fee6fd876fd9b19f7d0582473770252bb0b6f1313e2b3e67b8d33bc2
Instruction ID: 705c49607cd9e09248a5fe22d2e6320ca494c65325cbcc3e842bccd471215b3e
Opcode Fuzzy Hash: a3950751fee6fd876fd9b19f7d0582473770252bb0b6f1313e2b3e67b8d33bc2
Instruction Fuzzy Hash: 0E0168B89087519FC340DF29C18151ABBE1FF88600F91882EE9C99B311E739E9859F82

Uniqueness

Uniqueness Score: -1.00%

Function 100194D1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 100194D8
mv_strerror.MAIN ref: 100194FE

Part of subcall function 10013B30: mv_strlcpy.MAIN ref: 10013B71

mv_log.MAIN ref: 1001951B
_close.MSVCRT ref: 10019523

Strings

Error occurred in fstat(): %s, xrefs: 1001950B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _close_errnomv_logmv_strerrormv_strlcpy
String ID: Error occurred in fstat(): %s
API String ID: 1199337903-68092211
Opcode ID: fe60c93a3a69f3fb052d7518d5be4b5d53371f27e76a69ea24f993d483ec9b6c
Instruction ID: 16cc7446d487878674d3b6b426b97f2481dfa04c85c7ba054179e642ea7d2528
Opcode Fuzzy Hash: fe60c93a3a69f3fb052d7518d5be4b5d53371f27e76a69ea24f993d483ec9b6c
Instruction Fuzzy Hash: D5F092B48097159FC310EF14C48425AFBE4FF84700F41C82EE5D99B361DBB4A9859B82

Uniqueness

Uniqueness Score: -1.00%

Function 100261E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15COMMON

Download Yara Rule

APIs

mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100272BA), ref: 10026214
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,100272BA), ref: 10026219

Strings

val || !min_size, xrefs: 100261FA
Assertion %s failed at %s:%d, xrefs: 100261EC
libavutil/mem.c, xrefs: 100261F1

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_log
String ID: Assertion %s failed at %s:%d$libavutil/mem.c$val || !min_size
API String ID: 2075109169-2043513658
Opcode ID: e7e30a6a0de43b51050d007a56aa4d2eb09a9faf66d078cd7bb3a4404be27e90
Instruction ID: 7b7f116074881568e08956f9dc360710bb9d07d4c08e9fc45df01861e4a7bb4b
Opcode Fuzzy Hash: e7e30a6a0de43b51050d007a56aa4d2eb09a9faf66d078cd7bb3a4404be27e90
Instruction Fuzzy Hash: 07E04C745493459FC344DF69911160EBBE1EB88700F51C82DE59CC7349D778D4449B57

Uniqueness

Uniqueness Score: -1.00%

Function 1008E410 Relevance: 7.7, APIs: 5, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d33e5ae2fdebf123d5d6c44a8726b7159fae46d8a505568c5676af4475ca4e
Instruction ID: 673c3b97693f899d3c2f50e5342af0a7e5fead6986cad9ee1b36c1617013f18f
Opcode Fuzzy Hash: 55d33e5ae2fdebf123d5d6c44a8726b7159fae46d8a505568c5676af4475ca4e
Instruction Fuzzy Hash: 0D917D71E006A68FCB10DF68C98074EB7F4FF88394F46896AE854A7259E734FD508B91

Uniqueness

Uniqueness Score: -1.00%

Function 1004CB2B Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

mv_tree_insert.MAIN ref: 1004C57E
mv_tree_find.MAIN ref: 1004CBB8
mv_tree_find.MAIN ref: 1004CBD3
mv_tree_find.MAIN ref: 1004CC31
mv_tree_find.MAIN ref: 1004CC48

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find$mv_tree_insert
String ID:
API String ID: 3047205218-0
Opcode ID: 43d8240786b9d873e81d273712abfc48f6f278bf5570dac8054a8e241964c1c2
Instruction ID: 7395b7de8d56b61535b97ca67770b11dfb2ebccadb2f58b829e2396d941cbeca
Opcode Fuzzy Hash: 43d8240786b9d873e81d273712abfc48f6f278bf5570dac8054a8e241964c1c2
Instruction Fuzzy Hash: 7E51D0B590974A9FC340DF6AC08091AFBE1FF88650F61C92EE998D7301E734E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 10007100 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10007126
strchr.MSVCRT ref: 1000715B
strncmp.MSVCRT ref: 10007200
strlen.MSVCRT ref: 1000724B

Strings

-, xrefs: 10007232

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$strchrstrncmp
String ID: -
API String ID: 2264528763-2547889144
Opcode ID: 48f7d506b45c4cfb1b097bd66a56f7f6b4d5827668b9fbc93cb44df58068eac6
Instruction ID: 2e89a320e1afa525ac89b1a85f99ca85d7156f5341a68399cbbe94f8cfb36377
Opcode Fuzzy Hash: 48f7d506b45c4cfb1b097bd66a56f7f6b4d5827668b9fbc93cb44df58068eac6
Instruction Fuzzy Hash: 8C318F75A083918FEB10DA78949025EBBE1FF89284F05492EE9C8D7249E278D906D792

Uniqueness

Uniqueness Score: -1.00%

Function 1001CB30 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

mv_sha512_final.MAIN ref: 1001CC05
mv_ripemd_final.MAIN ref: 1001CC4D
mv_sha_final.MAIN ref: 1001CCAD
mv_md5_final.MAIN ref: 1001CCFD
mv_murmur3_final.MAIN ref: 1001CD1D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_md5_finalmv_murmur3_finalmv_ripemd_finalmv_sha512_finalmv_sha_final
String ID:
API String ID: 4068971256-0
Opcode ID: f37cc28a3601d7fc63d02b3976df016288c8a54453cabb540f98e0c6a177c8cf
Instruction ID: a9890341f039696cf52e9ef09c022f5312b08f746e4d76d58424e9ae9248baa2
Opcode Fuzzy Hash: f37cc28a3601d7fc63d02b3976df016288c8a54453cabb540f98e0c6a177c8cf
Instruction Fuzzy Hash: DC41E5B5A09345DFC700CF28C18451AB7E1FB89741F668C6DEA999B311D330ED85DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001E48C Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

mv_image_check_size.MAIN ref: 1001E4BA
mv_calloc.MAIN ref: 1001E519
mv_frame_alloc.MAIN ref: 1001E584
mv_frame_free.MAIN ref: 1001E5CB
mv_freep.MAIN ref: 1001E5DC
mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_callocmv_frame_allocmv_frame_freemv_freepmv_get_pix_fmt_namemv_image_check_sizemv_log
String ID:
API String ID: 473889652-0
Opcode ID: 9fa864ee1928c6bd1dd4db397f2e61f531e39c49d346cdfc62535eb3725c1c8c
Instruction ID: f0d2ef2185eafc4a44fc2f14c59591e06059a7926607cfdcd1216548b2331345
Opcode Fuzzy Hash: 9fa864ee1928c6bd1dd4db397f2e61f531e39c49d346cdfc62535eb3725c1c8c
Instruction Fuzzy Hash: C841E274604B828FD750DF69C480A0AF7E5FF88754F56892DE999DB321E770EC818B81

Uniqueness

Uniqueness Score: -1.00%

Function 1001E690 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

mv_hwframe_ctx_alloc.MAIN ref: 1001E6D0
mv_buffer_ref.MAIN ref: 1001E703
mv_buffer_ref.MAIN ref: 1001E77B
mv_buffer_unref.MAIN ref: 1001E79C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_ref$mv_buffer_unrefmv_hwframe_ctx_alloc
String ID:
API String ID: 2050485749-0
Opcode ID: d3ad7b980c272c66dfc6251d2f9a7c7bfdd2a05f411efaddebb324c9794b0f7c
Instruction ID: b949cf843239185fdb129f7a391c6e35efcc54fa384153f32d0a78a94b68c8eb
Opcode Fuzzy Hash: d3ad7b980c272c66dfc6251d2f9a7c7bfdd2a05f411efaddebb324c9794b0f7c
Instruction Fuzzy Hash: E0417078A087518FD744DF29C18091AFBE1FF89350F568A6DE8989B395D730EC81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 100A1540 Relevance: 7.6, APIs: 5, Instructions: 102threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 100A1580

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: aad5760cf48bfe59ace8456a0545fe3771cbea0c5a493778d31e095d93af85e1
Instruction ID: a603e3a71963cb926592ecdf01b935e1f93b8b32596d5f9433372c4bec14c4a6
Opcode Fuzzy Hash: aad5760cf48bfe59ace8456a0545fe3771cbea0c5a493778d31e095d93af85e1
Instruction Fuzzy Hash: AD31AE75B04612CBDB00EFA8C98439A77E5EBC03E0F598579E8598F249EA75CC40CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1000A480 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1000A4BA
mv_freep.MAIN ref: 1000A4E8
mv_freep.MAIN ref: 1000A541

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_mallocz
String ID:
API String ID: 2455733640-0
Opcode ID: 9f74527f40638788ac7371101fbd516078908c2a159fba3966d1ad274412a250
Instruction ID: 7473898efd5c84ff4cba6f3e963b26fd6c8cdcec3b0c7db7706523d113c4544c
Opcode Fuzzy Hash: 9f74527f40638788ac7371101fbd516078908c2a159fba3966d1ad274412a250
Instruction Fuzzy Hash: 2B31D074904B11CFD760DF25C88191AB7E0FF89391B168A5DEC999B719E730E880CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10012049 Relevance: 7.6, APIs: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1001205B
strlen.MSVCRT ref: 10012069
mv_realloc.MAIN ref: 1001207F

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_freep.MAIN ref: 100120D0

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$_aligned_reallocmv_freepmv_realloc
String ID:
API String ID: 895301365-0
Opcode ID: 0c29223b98c086e2b46ad98e7ce3030191046c0ef949241b854c2fd3e23e1c87
Instruction ID: 2d1e53f319068be23ad8f88d31967b5a2669bada8836d01dcbd6984a06f05035
Opcode Fuzzy Hash: 0c29223b98c086e2b46ad98e7ce3030191046c0ef949241b854c2fd3e23e1c87
Instruction Fuzzy Hash: 6131BDB99087018FC744CF29C18045AFBE1FF88718F158A6EE889AB311E731E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1000A650 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1000A66C
mv_freep.MAIN ref: 1000A69C
ReleaseSRWLockExclusive.KERNEL32 ref: 1000A6AB

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireReleasemv_freep
String ID:
API String ID: 2444013405-0
Opcode ID: 69b2e29afcab2b062c2147764c90657bebc76e2e75c4088fc9dd16b63d4a40d8
Instruction ID: 7158096d1edc9a63a07daa50029a30cfeb496985ca544081e00db1e7d26d72ff
Opcode Fuzzy Hash: 69b2e29afcab2b062c2147764c90657bebc76e2e75c4088fc9dd16b63d4a40d8
Instruction Fuzzy Hash: 3421DBB5604701CFD704EF25D5C591ABBF4FF89280F06C969E8898B31AE731E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10012239 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

mv_bprint_init.MAIN ref: 1001225D
mv_bprint_escape.MAIN ref: 100122B3
mv_bprint_append_data.MAIN ref: 100122CC
mv_bprint_escape.MAIN ref: 100122EE
mv_bprint_finalize.MAIN ref: 1001231B
mv_bprint_append_data.MAIN ref: 1001234B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_append_datamv_bprint_escape$mv_bprint_finalizemv_bprint_init
String ID:
API String ID: 3283265872-0
Opcode ID: 40e4fae6fe95c9ae0cafae5e4cfbe44df76d706b7c6edfb7b55f5239210fc438
Instruction ID: 90910876c942d1fbafe524e13dc9732c176e9ecd8d18a9c8de127334b5e1fd1f
Opcode Fuzzy Hash: 40e4fae6fe95c9ae0cafae5e4cfbe44df76d706b7c6edfb7b55f5239210fc438
Instruction Fuzzy Hash: 6121DDB59197059FC350DF28C18025AFBE1FF88354F51892EE99D87351E736E982CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10011483 Relevance: 7.6, APIs: 5, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10011491
strlen.MSVCRT ref: 1001149F
mv_realloc.MAIN ref: 100114B5

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_freep.MAIN ref: 100114E2

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$_aligned_reallocmv_freepmv_realloc
String ID:
API String ID: 895301365-0
Opcode ID: 04da3bf766d47488039e948dce66939b5b65f249d2add762eec63dcc3e51c44d
Instruction ID: 51621a72b6bbd22e45abe63bff26c18dabce81ca6188ceac0dc85253792fa2d5
Opcode Fuzzy Hash: 04da3bf766d47488039e948dce66939b5b65f249d2add762eec63dcc3e51c44d
Instruction Fuzzy Hash: F121B3B8908712CFCB14DF24C48055AB7E5FF89344F458A5EE9999B305E731EA46CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1009D6A0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 1009D6B9
_unlock.MSVCRT ref: 1009D6E1
calloc.MSVCRT ref: 1009D72F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 357fb2442f9bcdd85ef6b46d033be08ae312da071a22b7525909557a6230c189
Instruction ID: 6cddb97a3fd8d0d05461b53b71359434b8c1691dc6b4f2f6cc4d1d10a1eaf7a4
Opcode Fuzzy Hash: 357fb2442f9bcdd85ef6b46d033be08ae312da071a22b7525909557a6230c189
Instruction Fuzzy Hash: BF115E75544201CFDB40EF78C59071ABBE4FF84250F16896AD98CCF249EB74D840EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001232B Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

mv_bprint_escape.MAIN ref: 100122B3

Part of subcall function 10009730: mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB

mv_bprint_append_data.MAIN ref: 100122CC
mv_bprint_escape.MAIN ref: 100122EE
mv_bprint_finalize.MAIN ref: 1001231B
mv_bprint_append_data.MAIN ref: 1001234B

Part of subcall function 10008F30: mv_realloc.MAIN ref: 10008F73

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_append_datamv_bprint_escape$mv_bprint_finalizemv_bprintfmv_realloc
String ID:
API String ID: 1942445456-0
Opcode ID: 5e9e0b7bf5f3d5346bbbc040ec1caf168d6988dfb1b18155a4329e28a55b4eeb
Instruction ID: 403ebcfaa7f6bf6d2df9c5cc3f9910434a712b72dc8362acc2447b37bc06364c
Opcode Fuzzy Hash: 5e9e0b7bf5f3d5346bbbc040ec1caf168d6988dfb1b18155a4329e28a55b4eeb
Instruction Fuzzy Hash: 752199B59183019FD360DF29C08069AFBE1FB89348F50892EE58CC7301E736E981CB46

Uniqueness

Uniqueness Score: -1.00%

Function 10011A87 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10011A5F
mv_freep.MAIN ref: 10011A6B
mv_mallocz.MAIN ref: 10011A97
mv_freep.MAIN ref: 10011AE6
mv_freep.MAIN ref: 10011AF2
mv_freep.MAIN ref: 10011B36
mv_freep.MAIN ref: 10011B42

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_mallocz
String ID:
API String ID: 2455733640-0
Opcode ID: d5c1c30fc960bf7640f1f1bb9a1ad17a8736e34e7bb0e74a488f3468996d7490
Instruction ID: e27aaf6f2fbb493ff670743c398b5037914b47ddc08bede214f16f72f1dc21d1
Opcode Fuzzy Hash: d5c1c30fc960bf7640f1f1bb9a1ad17a8736e34e7bb0e74a488f3468996d7490
Instruction Fuzzy Hash: E50119756097548FC740EFB8D88175AB7E4FF48290F81582DF894C7200EB31E8448B82

Uniqueness

Uniqueness Score: -1.00%

Function 1001DAE8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

mv_buffer_ref.MAIN ref: 1001D9F6
mv_buffer_create.MAIN ref: 1001DA2F
mv_buffer_unref.MAIN ref: 1001DA99
mv_freep.MAIN ref: 1001DAAF
mv_freep.MAIN ref: 1001DABE
mv_freep.MAIN ref: 1001DACD
mv_freep.MAIN ref: 1001DAD9
mv_mallocz.MAIN ref: 1001DAF7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unrefmv_mallocz
String ID:
API String ID: 3470597486-0
Opcode ID: 3a33ffab89d5aed0bf03c31c6abfb545fd4a93970b8c716d4a66c5e27936259d
Instruction ID: ec82959c7a140a0cfaaa292ac1a12e2931abf6bf560108a204ed996edac76e07
Opcode Fuzzy Hash: 3a33ffab89d5aed0bf03c31c6abfb545fd4a93970b8c716d4a66c5e27936259d
Instruction Fuzzy Hash: D5011D796087808FD740EF34D88161ABBE0FF88248F858D2EE4898B306E631E444CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1000C7D9 Relevance: 7.5, APIs: 5, Instructions: 36stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 1000C7E0
strtol.MSVCRT ref: 1000C804
_errno.MSVCRT ref: 1000C80B
_errno.MSVCRT ref: 1000C822
_errno.MSVCRT ref: 1000C848

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$strtol
String ID:
API String ID: 3596500743-0
Opcode ID: 94420cbffd51064d18b4594c717699c8f84a31741584a0f27c6857c5b8a8326f
Instruction ID: e5a68f2e7340340f2a0c1abd8e62d28df7ecd48bc61271be75172e8c5bb86d30
Opcode Fuzzy Hash: 94420cbffd51064d18b4594c717699c8f84a31741584a0f27c6857c5b8a8326f
Instruction Fuzzy Hash: CD01E474A0931A9FD744EF65C88871ABBE2FF85740F55C86DE88987724EB74E8408B42

Uniqueness

Uniqueness Score: -1.00%

Function 1004B020 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004B02F
mv_fifo_can_read.MAIN ref: 1004B03C
mv_fifo_read_to_cb.MAIN ref: 1004B066
WakeAllConditionVariable.KERNEL32 ref: 1004B071
ReleaseSRWLockExclusive.KERNEL32 ref: 1004B07D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWakemv_fifo_can_readmv_fifo_read_to_cb
String ID:
API String ID: 93134951-0
Opcode ID: b04aa90755bf11445e363e889d079bebaf352ae153b96380cc2547109b9fea1a
Instruction ID: f622ea8ca44b4a077811579624edcdfc0bd4128ea1142ae48ea321c74ce907da
Opcode Fuzzy Hash: b04aa90755bf11445e363e889d079bebaf352ae153b96380cc2547109b9fea1a
Instruction Fuzzy Hash: D5F0B6F5908A109FCB40FF39E5C550ABBE0EF45644F41892DF8898B209E634E595CB93

Uniqueness

Uniqueness Score: -1.00%

Function 1002ECB4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

january, xrefs: 1002ED12
%H:%M:%S, xrefs: 1002EEFB

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %H:%M:%S$january
API String ID: 0-1137272109
Opcode ID: da1f36b84d7af4fdb6ff05d36d3489775bfe1df94d238dbe8e3b83eb8beb8c03
Instruction ID: 1a6015d922a8a1d413538802668cef626f0345cf37966592b88f7aefc4975a0d
Opcode Fuzzy Hash: da1f36b84d7af4fdb6ff05d36d3489775bfe1df94d238dbe8e3b83eb8beb8c03
Instruction Fuzzy Hash: B68197304446A78ECB10CF18D0D06BDFBE6FF86344BD548AAC5558F166E731AD86CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1002ED03 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

mv_strncasecmp.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002ED37
mv_small_strptime.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1002EF08

Strings

january, xrefs: 1002ED12
%H:%M:%S, xrefs: 1002EEFB

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_small_strptimemv_strncasecmp
String ID: %H:%M:%S$january
API String ID: 2521375588-1137272109
Opcode ID: c23b57dc3167bd017810ec458589473e5dbae91a71e364c676c9f5f1783f0ed0
Instruction ID: 710b8ac18492e9dbadc839224101dd6a7d5d44d566cabf85fed6607768a5e8af
Opcode Fuzzy Hash: c23b57dc3167bd017810ec458589473e5dbae91a71e364c676c9f5f1783f0ed0
Instruction Fuzzy Hash: EE8162304446A78ECB50CF18D0D05ADFBE6FF86340BD548AAC5568F166E731A986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1002A192 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002A471

Strings

Value %f for parameter '%s' out of range [%g - %g], xrefs: 1002A44E
Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 1002A41D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
API String ID: 2835281190-116802341
Opcode ID: 307d38743698b291979d8cba9ea0ea86772061f596d5267834f9e20a1e2d30a9
Instruction ID: 36e62bc8f0de24f566176e25824a2ed98854e2226bbbd516fe818f77359d1b1a
Opcode Fuzzy Hash: 307d38743698b291979d8cba9ea0ea86772061f596d5267834f9e20a1e2d30a9
Instruction Fuzzy Hash: 5D71AC35918F45CBC382DF38E48111AFBA5FFDB2E0F91971AF8966A250DB3084C19742

Uniqueness

Uniqueness Score: -1.00%

Function 100204C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

mv_image_get_linesize.MAIN ref: 10020524

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_image_fill_linesizes.MAIN(?), ref: 100205B2

Strings

Picture size %ux%u is invalid, xrefs: 10020635

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_fill_linesizesmv_image_get_linesizemv_pix_fmt_desc_get
String ID: Picture size %ux%u is invalid
API String ID: 547003755-1963597007
Opcode ID: 55cc673a7fd8fa65950412ae644b1255500889416eca15a6256c6aad94377d03
Instruction ID: 76d0c1c0ea3a07b63bf36c4eb498433e90d4a1915968e7ac4ed20e6f6339bb64
Opcode Fuzzy Hash: 55cc673a7fd8fa65950412ae644b1255500889416eca15a6256c6aad94377d03
Instruction Fuzzy Hash: 73412576A097508FC350CF29D88074ABBE2FFC8610F558A2EF9A8CB351E634D8418F42

Uniqueness

Uniqueness Score: -1.00%

Function 100281D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 100284FD

Strings

Value %f for parameter '%s' out of range [%g - %g], xrefs: 100284E1
Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 10028528

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
API String ID: 2418673259-116802341
Opcode ID: 0e86dea9d7dbfb0fa736b3973e9ea318f8df20d9c4df400857962a6312e3acc6
Instruction ID: 4b2a81cc611bfd366bf19134ab3879e08e1fa9318fff0f4b80787780fc68846e
Opcode Fuzzy Hash: 0e86dea9d7dbfb0fa736b3973e9ea318f8df20d9c4df400857962a6312e3acc6
Instruction Fuzzy Hash: A0414A3581AF958BC382DF38909111BF7E4FFDA380F819B5EF88676652C73095428742

Uniqueness

Uniqueness Score: -1.00%

Function 1000D684 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000D64E
mv_bprintf.MAIN ref: 1000D678
mv_bprintf.MAIN ref: 1000D715

Strings

@%s, xrefs: 1000D642

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: @%s
API String ID: 3083893021-2921637043
Opcode ID: 3226884ed7a48c89542cb2da4cd6bdc3bde8d4d284e963f694dc1568948eeeaa
Instruction ID: 3992f4aefadd0f47064a5f8236616475ea9e2f99c0eaa1b511875076a351044c
Opcode Fuzzy Hash: 3226884ed7a48c89542cb2da4cd6bdc3bde8d4d284e963f694dc1568948eeeaa
Instruction Fuzzy Hash: F32128719087168BE350EF59C48022EF7E1FB98394F12892EE89897315E731ED55CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1002E5D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

mv_expr_parse_and_eval.MAIN ref: 1002E659

Part of subcall function 100177F0: mv_expr_parse.MAIN ref: 10017862
Part of subcall function 100177F0: mv_expr_free.MAIN ref: 100178D7
Part of subcall function 100177F0: mv_expr_free.MAIN ref: 100178E6
Part of subcall function 100177F0: mv_expr_free.MAIN ref: 100178F5
Part of subcall function 100177F0: mv_freep.MAIN ref: 10017904
Part of subcall function 100177F0: mv_freep.MAIN ref: 1001790C
Part of subcall function 100177F0: mv_expr_free.MAIN ref: 10017926
Part of subcall function 100177F0: mv_expr_free.MAIN ref: 10017935
Part of subcall function 100177F0: mv_expr_free.MAIN ref: 10017944
Part of subcall function 100177F0: mv_freep.MAIN ref: 10017953
Part of subcall function 100177F0: mv_freep.MAIN ref: 1001795B

mv_d2q.MAIN ref: 1002E675
mv_reduce.MAIN ref: 1002E6C9

Strings

%d:%d%c, xrefs: 1002E5EF

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_free$mv_freep$mv_d2qmv_expr_parsemv_expr_parse_and_evalmv_reduce
String ID: %d:%d%c
API String ID: 3833080124-2624059611
Opcode ID: c0dab5111b246b7793677cbea3694c592915a4b51e12e4901537c35080ba4451
Instruction ID: 32cee4adaa6e940534327489766bd4286550dcd166c12c6ab9e9ab54eb2fc32a
Opcode Fuzzy Hash: c0dab5111b246b7793677cbea3694c592915a4b51e12e4901537c35080ba4451
Instruction Fuzzy Hash: 143157B59193419FC740DF29C58010AFBE1BF89784F458D2EF989DB311E7B0E9448B82

Uniqueness

Uniqueness Score: -1.00%

Function 10029794 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 100292C3
mv_log.MAIN ref: 100292ED
mv_log.MAIN ref: 10029391
mv_log.MAIN ref: 1002977B

Strings

%-15s , xrefs: 100292D4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$strcmp
String ID: %-15s
API String ID: 1163046698-755444208
Opcode ID: 95967de6711d041c351af1bc06a49e10b9f53db266bf100d43d0bd2239a687f0
Instruction ID: ce635d268765be07717733ae1f701fccf88d57a4aae717667b6e3b1a655ee8de
Opcode Fuzzy Hash: 95967de6711d041c351af1bc06a49e10b9f53db266bf100d43d0bd2239a687f0
Instruction Fuzzy Hash: 8B21B278A093459FCB50DF28E09069EB7E1EF88B80F92C82DE89997351D374E940DB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002EABC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtoul.MSVCRT ref: 1002EA06
strspn.MSVCRT ref: 1002EAD4
bsearch.MSVCRT ref: 1002EB0A
strtoul.MSVCRT ref: 1002EB74
mv_log.MAIN ref: 1002EC38

Strings

0123456789ABCDEFabcdef, xrefs: 1002EACB

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strtoul$bsearchmv_logstrspn
String ID: 0123456789ABCDEFabcdef
API String ID: 1580567553-1534423534
Opcode ID: 6dcbd6786ac768134bc4aa73a149e3e70a2694ee29ea86bff127d4d9bdbdeff6
Instruction ID: 1049657c988276e6ddf893df4eb424eafbb891710bb151af54785349b2433993
Opcode Fuzzy Hash: 6dcbd6786ac768134bc4aa73a149e3e70a2694ee29ea86bff127d4d9bdbdeff6
Instruction Fuzzy Hash: 1E21AF719487C59ED752CF34909171ABBE4EF81380F85CA6FE4899B241E738CD80C712

Uniqueness

Uniqueness Score: -1.00%

Function 1002E6E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002E70F

Strings

ntsc, xrefs: 1002E6E1

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp
String ID: ntsc
API String ID: 1004003707-2045543799
Opcode ID: 45332122925daee58b0ca36453adb93a54a139fa692ca5e16f6db20bb7fad8e3
Instruction ID: a92f6e95659317827b4528b13064fbf16e1d4fcf51acc17d8aa5f4157741274d
Opcode Fuzzy Hash: 45332122925daee58b0ca36453adb93a54a139fa692ca5e16f6db20bb7fad8e3
Instruction Fuzzy Hash: A5111CB4A483829FE300DF69E4C065ABBE5EF85340F95896AF49897361D370EC81DB42

Uniqueness

Uniqueness Score: -1.00%

Function 10023C10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 10023C72
mv_log.MAIN ref: 10023C8C

Strings

is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented., xrefs: 10023C60
If you want to help, upload a sample of this file to https://streams.videolan.org/upload/ and contact the ffmpeg-devel mailing list. (ffmpeg-devel@ffmpeg.org), xrefs: 10023C77

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented.$If you want to help, upload a sample of this file to https://streams.videolan.org/upload/ and contact the ffmpeg-devel mailing list. (ffmpeg-devel@ffmpeg.org)
API String ID: 2418673259-452301706
Opcode ID: 230dbaebe5e0e4e5d2fd49e39d960bd16ff9093515a21cc462a8ac1e4ebb75bb
Instruction ID: b38fd93bf2376516fa3ca80b921a4e2a6c4b8f69125c60dcef1e2184f80e32d5
Opcode Fuzzy Hash: 230dbaebe5e0e4e5d2fd49e39d960bd16ff9093515a21cc462a8ac1e4ebb75bb
Instruction Fuzzy Hash: 2E115B74A083119BD348CF19D0C021EFBE1FFC8740FA0C92DE5889B305CA34D9449B82

Uniqueness

Uniqueness Score: -1.00%

Function 1002F736 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

mv_small_strptime.MAIN ref: 1002F750
_errno.MSVCRT ref: 1002F76D

Part of subcall function 1008F920: _errno.MSVCRT ref: 1008FAD0

_errno.MSVCRT ref: 1002F7A6

Strings

%M:%S, xrefs: 1002F744

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$mv_small_strptime
String ID: %M:%S
API String ID: 1751681387-2500880230
Opcode ID: f2beb3df4ee0f6f61ca7a34fa68ce2ceebecdb36893305a6cf37f0a46d557ff3
Instruction ID: 08dd91ef31b92b14981fe1afeff638f908fd3777591abbf69ec9e5e015226bf1
Opcode Fuzzy Hash: f2beb3df4ee0f6f61ca7a34fa68ce2ceebecdb36893305a6cf37f0a46d557ff3
Instruction Fuzzy Hash: 10010C75A05305DFD764DF29D45076EBBE0FB84280F51883EE899C3250EA3098458F92

Uniqueness

Uniqueness Score: -1.00%

Function 1002D72B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

mv_dict_get.MAIN ref: 1002D6AB
mv_opt_set.MAIN ref: 1002D6CF
mv_log.MAIN ref: 1002D70E
mv_dict_free.MAIN ref: 1002D71A
mv_dict_set.MAIN ref: 1002D74F

Strings

Error setting option %s to value %s., xrefs: 1002D6F7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_freemv_dict_getmv_dict_setmv_logmv_opt_set
String ID: Error setting option %s to value %s.
API String ID: 1354616078-3279051434
Opcode ID: be12c7fe19db5ab61db51b4a1bede206e01a94ada12606f0a4e7e7a9321a0867
Instruction ID: 6b9ea6aabfc4124447e1f2434b6fc2a42ecd06c72756f075168a49251e9f20a7
Opcode Fuzzy Hash: be12c7fe19db5ab61db51b4a1bede206e01a94ada12606f0a4e7e7a9321a0867
Instruction Fuzzy Hash: B6017AB9A08304AFC744DF28D48059ABBE0FB88354F10892EF99CD7310E634EA409F86

Uniqueness

Uniqueness Score: -1.00%

Function 10009784 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097AD
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C05
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C65

Strings

>, xrefs: 100097E9
&, xrefs: 1000979B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: &$>
API String ID: 3083893021-624094588
Opcode ID: 3a0184e92dcb7e1e473096fa467e9c05a6d80c2d3150c9be7b04146b26d57726
Instruction ID: 4c5438aa6a129c9ce896481cefdf623b6b0dbe5659d14e32da422b5388819884
Opcode Fuzzy Hash: 3a0184e92dcb7e1e473096fa467e9c05a6d80c2d3150c9be7b04146b26d57726
Instruction Fuzzy Hash: 0EF03071C08B59CADB50EF68855079AB7E5EB853D0F86480EE4DA9B209C734FC86C782

Uniqueness

Uniqueness Score: -1.00%

Function 10009A08 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A35
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A7B
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C25
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C45

Strings

', xrefs: 10009A23
>, xrefs: 10009A69

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: '$>
API String ID: 3083893021-1996891769
Opcode ID: 42ebd6a35695f5f76d849163282aa4592941da0a2ecac70b33ec663c14a5c16d
Instruction ID: 833e2b3188953a1b3be8fb8ff8af71bd57aa8e074cd88eba3086a03673e998a7
Opcode Fuzzy Hash: 42ebd6a35695f5f76d849163282aa4592941da0a2ecac70b33ec663c14a5c16d
Instruction Fuzzy Hash: 8CF05430C18B59CAD710EF64805076AB7D1EB463C0F868C0EE5D55B209C734B8C2C797

Uniqueness

Uniqueness Score: -1.00%

Function 10023CA7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 10023C72
mv_log.MAIN ref: 10023C8C

Strings

is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented., xrefs: 10023C60
If you want to help, upload a sample of this file to https://streams.videolan.org/upload/ and contact the ffmpeg-devel mailing list. (ffmpeg-devel@ffmpeg.org), xrefs: 10023C77

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented.$If you want to help, upload a sample of this file to https://streams.videolan.org/upload/ and contact the ffmpeg-devel mailing list. (ffmpeg-devel@ffmpeg.org)
API String ID: 2418673259-452301706
Opcode ID: a0c93aaa47001a34f58e2308fc1ec211f7dec6f73e83185b1537ec96549854ca
Instruction ID: 886f968a28aae92c15b08deec43e2d82c5518afaae295dcd8615bb27afa3f2ae
Opcode Fuzzy Hash: a0c93aaa47001a34f58e2308fc1ec211f7dec6f73e83185b1537ec96549854ca
Instruction Fuzzy Hash: 8DF092B8908701ABC744DF29C48026EFBE0EFC9740F90C92DA599A7311D634A944AB82

Uniqueness

Uniqueness Score: -1.00%

Function 10023C99 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 10023C72
mv_log.MAIN ref: 10023C8C

Strings

is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented., xrefs: 10023C60
If you want to help, upload a sample of this file to https://streams.videolan.org/upload/ and contact the ffmpeg-devel mailing list. (ffmpeg-devel@ffmpeg.org), xrefs: 10023C77

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented.$If you want to help, upload a sample of this file to https://streams.videolan.org/upload/ and contact the ffmpeg-devel mailing list. (ffmpeg-devel@ffmpeg.org)
API String ID: 2418673259-452301706
Opcode ID: 30c5f155cf30ad4fe55d29e70c345d09921be7e77fc4418659e73a55076c239c
Instruction ID: 0bc80df8ba14884a832d019a40eab41463885c0e821bf5b94f85b96151d47782
Opcode Fuzzy Hash: 30c5f155cf30ad4fe55d29e70c345d09921be7e77fc4418659e73a55076c239c
Instruction Fuzzy Hash: 35F067B8908701ABC744DF19D08125EFBE1FFC9740F91C92DA5DDA7351DA34E944AB82

Uniqueness

Uniqueness Score: -1.00%

Function 1000F9A9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1000F99A
mv_log.MAIN ref: 1000F9D1

Strings

overriding to %d logical cores, xrefs: 1000F981
detected %d logical cores, xrefs: 1000F9B4

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: detected %d logical cores$overriding to %d logical cores
API String ID: 2418673259-3421371979
Opcode ID: 0759295ed6044173e9392d2661279fec986e6af074d162e95bf04f3e6d97d716
Instruction ID: 4351d7ad1e4b7553753ed5daeab53ed97445378c9d31bf055318a612fe487827
Opcode Fuzzy Hash: 0759295ed6044173e9392d2661279fec986e6af074d162e95bf04f3e6d97d716
Instruction Fuzzy Hash: A4F06CB0A08341AFD340DF59C09171ABBE0EB88740F90C82EE6D987361D679A9459F87

Uniqueness

Uniqueness Score: -1.00%

Function 1002D35B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1002D379

Strings

Key '%s' not found., xrefs: 1002D364

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: Key '%s' not found.
API String ID: 2418673259-2052305073
Opcode ID: b6e5dbdcddb3e8e537d9606f4ee5ef41b23fddcb67c58fcbb9e80a7253b86ab3
Instruction ID: 2935cc58392a1398e58e060f8426a77ac91e2dc20dd80442988a03116b7c0377
Opcode Fuzzy Hash: b6e5dbdcddb3e8e537d9606f4ee5ef41b23fddcb67c58fcbb9e80a7253b86ab3
Instruction Fuzzy Hash: CBE075755087509FC304DF28E48111EFBE0EF88354F41C82EE5CD97315DA75E4418B82

Uniqueness

Uniqueness Score: -1.00%

Function 100252F0 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

mv_mul_q.MAIN ref: 10025352

Part of subcall function 10032DA0: mv_reduce.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,10025357), ref: 10032DE1

mv_rescale_rnd.MAIN ref: 100253F3
mv_rescale_rnd.MAIN ref: 10025420

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_rescale_rnd$mv_mul_qmv_reduce
String ID:
API String ID: 3269292098-0
Opcode ID: b50e5d1874e335783e8f5a6a831900d86d3a57486d0b88453f95c6126a562e0d
Instruction ID: 7a4d74e7e2a0161bf1f379c5bd56ad13f195e656a433c0a89533b9deccd96d44
Opcode Fuzzy Hash: b50e5d1874e335783e8f5a6a831900d86d3a57486d0b88453f95c6126a562e0d
Instruction Fuzzy Hash: 8A61B074A097409FC344CF29D48060AFBE1BFC8764F548A2EF8A993360D771E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1003A320 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

mv_samples_get_buffer_size.MAIN ref: 1003A34E
mv_malloc.MAIN ref: 1003A360
mv_samples_fill_arrays.MAIN ref: 1003A396

Part of subcall function 1003A1B0: mv_samples_get_buffer_size.MAIN ref: 1003A201

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_samples_get_buffer_size$mv_mallocmv_samples_fill_arrays
String ID:
API String ID: 3894167361-0
Opcode ID: 8d336f63005a17f0ce2746193248b8f2ccff729fc354cbe18226dd819581e305
Instruction ID: 29f813314073505780b3b6a0bf21f4ec65a179872cc3375d0f3d993001abd10e
Opcode Fuzzy Hash: 8d336f63005a17f0ce2746193248b8f2ccff729fc354cbe18226dd819581e305
Instruction Fuzzy Hash: 0A419D75E083018FD705CF29C58460EFBE6EFCA355F55892EE8888B350E7B5E9858B42

Uniqueness

Uniqueness Score: -1.00%

Function 1001B0A4 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

mv_image_fill_linesizes.MAIN ref: 1001B0C8

Part of subcall function 1001EAB0: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6

mv_image_fill_plane_sizes.MAIN ref: 1001B15D
mv_buffer_alloc.MAIN ref: 1001B1CD
mv_image_fill_pointers.MAIN ref: 1001B1FC

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_allocmv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_fill_pointersmv_pix_fmt_desc_get
String ID:
API String ID: 2879504290-0
Opcode ID: 7341e7224c3c084a21f5b683c78ee4c84bc759b0f2a3afcbc0be0c244e6f78e6
Instruction ID: 8f506c5f79b5a5d03f9a5ada546bbcf13e993700c3781cdda1da6b75d303e5b0
Opcode Fuzzy Hash: 7341e7224c3c084a21f5b683c78ee4c84bc759b0f2a3afcbc0be0c244e6f78e6
Instruction Fuzzy Hash: 4151F9B5608B018FCB48DF69D5D066ABBE1FF88240F15897DE949CB359E731E884CB41

Uniqueness

Uniqueness Score: -1.00%

Function 10028BF0 Relevance: 6.1, APIs: 4, Instructions: 106stringCOMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10028BFE
strlen.MSVCRT ref: 10028C15
mv_malloc.MAIN ref: 10028C31

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freepmv_mallocstrlen
String ID:
API String ID: 2899962033-0
Opcode ID: d3cbb643a15584800d87b347b60d1828047597c4cb2b6690052b8dbfac92f044
Instruction ID: da0430723362ddf2c70966634cf1ee0475581ecf6b1598c901b20758b4b2d645
Opcode Fuzzy Hash: d3cbb643a15584800d87b347b60d1828047597c4cb2b6690052b8dbfac92f044
Instruction Fuzzy Hash: 4731697DA0B7514ED310DD39A88139ABBC5DB52394FE1012FFA94877C3D2368A888761

Uniqueness

Uniqueness Score: -1.00%

Function 100290D0 Relevance: 6.1, APIs: 4, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10029155
mv_strlcatf.MAIN ref: 1002919C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strlcatfstrcmp
String ID:
API String ID: 3138383634-0
Opcode ID: e6d04f5b88f278462d021f45b59cfba453c363faba32e7f9e0e655f4c856f37f
Instruction ID: 4e00ca5e32ba23cd1f0d150041dade036c75141da2ff9e4549c40cdffe91d108
Opcode Fuzzy Hash: e6d04f5b88f278462d021f45b59cfba453c363faba32e7f9e0e655f4c856f37f
Instruction Fuzzy Hash: 3C316B75A083968FDB10DF6AE48475BBBE4EF84384F55486EEC9897201D334ED18CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001ABCC Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

mv_dict_copy.MAIN ref: 1001A996
mv_buffer_ref.MAIN ref: 1001A9EC
mv_realloc.MAIN ref: 1001AA26
mv_mallocz.MAIN ref: 1001AA40

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_refmv_dict_copymv_malloczmv_realloc
String ID:
API String ID: 2487838726-0
Opcode ID: d6cd806141a99ea9e6499acbdad17ae164cd7a021d82df45f2779087113250f0
Instruction ID: 71aa3552cec3486bca5ca0761ce303518d9a4190903ce0134960d920c450457d
Opcode Fuzzy Hash: d6cd806141a99ea9e6499acbdad17ae164cd7a021d82df45f2779087113250f0
Instruction Fuzzy Hash: 0741F675908382CFCB14CF25C18065AB7E1FF89354F06896DE99AAB351E730E985CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1009D7D0 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 1009D822
MultiByteToWideChar.KERNEL32 ref: 1009D865

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: e06c874c7b0f77f595b58fe30017b44e27d557a91db68f2b64ff68b0ac9c3ef2
Instruction ID: b6030a99734b0483f6aa4200c2ea406aadadd20ec724542bcc610d09dc4c1d1f
Opcode Fuzzy Hash: e06c874c7b0f77f595b58fe30017b44e27d557a91db68f2b64ff68b0ac9c3ef2
Instruction Fuzzy Hash: 8431E2B45093918FD700EF68D58424BBBF0FF85354F00895EE8988B252D7BAD849DB92

Uniqueness

Uniqueness Score: -1.00%

Function 10032734 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

clock.MSVCRT ref: 10032773
mv_sha_init.MAIN ref: 1003280D
mv_sha_update.MAIN ref: 10032827
mv_sha_final.MAIN ref: 10032837

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: clockmv_sha_finalmv_sha_initmv_sha_update
String ID:
API String ID: 679641161-0
Opcode ID: 6f861df05181ea4ff24294a19bc8cb2a57f6845d629d0ae6cd75aa9bb61d67ba
Instruction ID: 2963d4e084b8430f89c99bd8ea125613e8711b22e7604053a18660b36ac50186
Opcode Fuzzy Hash: 6f861df05181ea4ff24294a19bc8cb2a57f6845d629d0ae6cd75aa9bb61d67ba
Instruction Fuzzy Hash: 63218D76A043108FE308EF38CAC424AB7E2EBC8316F95C93DDD889B355DA75D9058B91

Uniqueness

Uniqueness Score: -1.00%

Function 1004D990 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 1004D9EA
mv_freep.MAIN ref: 1004D9F5
mv_freep.MAIN ref: 1004DA00
mv_freep.MAIN ref: 1004DA0B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: f6c835cecb9b432747f0724a4b87d8a480359914a73334c022d9ec15b06e4bbe
Instruction ID: 4b93469b2fa915594c7db15a2f039bf375a42de5f61fa3055b3fc1793515d148
Opcode Fuzzy Hash: f6c835cecb9b432747f0724a4b87d8a480359914a73334c022d9ec15b06e4bbe
Instruction Fuzzy Hash: 2B21D0B5A047218ADB10EF24E8C175A37E5EF40300F5A44BACC45CB24AE738D810C796

Uniqueness

Uniqueness Score: -1.00%

Function 1001E54B Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

mv_hwframe_get_buffer.MAIN ref: 1001E561

Part of subcall function 1001E2F0: mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E317
Part of subcall function 1001E2F0: mv_frame_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E32A
Part of subcall function 1001E2F0: mv_hwframe_map.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E36C
Part of subcall function 1001E2F0: mv_log.MAIN ref: 1001E396
Part of subcall function 1001E2F0: mv_frame_free.MAIN ref: 1001E3A2

mv_frame_alloc.MAIN ref: 1001E584

Part of subcall function 1001AC40: mv_malloc.MAIN ref: 1001AC56

mv_frame_free.MAIN ref: 1001E5CB
mv_freep.MAIN ref: 1001E5DC
mv_freep.MAIN ref: 1001E61B
mv_freep.MAIN ref: 1001E63A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_frame_allocmv_frame_free$mv_buffer_refmv_hwframe_get_buffermv_hwframe_mapmv_logmv_malloc
String ID:
API String ID: 2206481229-0
Opcode ID: 25283562a18f3cc925092daff3d8813b508f0ce4e67f46393089d96786ff75ef
Instruction ID: ca945ac18ed839ac5bf74ac2fa747fd2f81b9f58e27d0342db77472b587ece54
Opcode Fuzzy Hash: 25283562a18f3cc925092daff3d8813b508f0ce4e67f46393089d96786ff75ef
Instruction Fuzzy Hash: F42126756087518FD340DF29C880A4EF3E5FF89354F468869E988DB321E770EC858B41

Uniqueness

Uniqueness Score: -1.00%

Function 100027B0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

mv_fifo_can_read.MAIN ref: 100027C7
mv_fifo_can_write.MAIN ref: 100027D6
mv_samples_get_buffer_size.MAIN ref: 100027FF
mv_fifo_grow2.MAIN ref: 10002833

Part of subcall function 10017F70: mv_realloc_array.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002838), ref: 10017FAE

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_fifo_can_readmv_fifo_can_writemv_fifo_grow2mv_realloc_arraymv_samples_get_buffer_size
String ID:
API String ID: 78108474-0
Opcode ID: 0ae8dcb50c524f4d83e5332cc30a05b3d9202b551eefed4852725224eaea7f23
Instruction ID: aca124555f9e986d8ecf7dcc78e3baf80687684f5b36e82da0df567b59823915
Opcode Fuzzy Hash: 0ae8dcb50c524f4d83e5332cc30a05b3d9202b551eefed4852725224eaea7f23
Instruction Fuzzy Hash: 8611E378A093559FD700DF69C58094ABBE4FF88394F01892DFD88CB314E774E9458B92

Uniqueness

Uniqueness Score: -1.00%

Function 10009D20 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 10009D2F
ReleaseSRWLockExclusive.KERNEL32 ref: 10009D43
mv_freep.MAIN ref: 10009D8C
mv_freep.MAIN ref: 10009DB2

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLockmv_freep$AcquireRelease
String ID:
API String ID: 3724862848-0
Opcode ID: 165c7a7ead69ea206258ba1bb83b78d255aa42c3906e7f588b7a955e89b15c52
Instruction ID: 481799aab59401a05a94c431fcd606f02005709352fa09c91304ba663852098c
Opcode Fuzzy Hash: 165c7a7ead69ea206258ba1bb83b78d255aa42c3906e7f588b7a955e89b15c52
Instruction Fuzzy Hash: C611BCB55087008FDB14EF25D5C555ABBF4FF48250F05896EE8898B31AE730E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A1390 Relevance: 6.1, APIs: 4, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 100A13AD
GetTickCount64.KERNEL32 ref: 100A13C0
WaitForSingleObject.KERNEL32 ref: 100A13D7
WaitForSingleObject.KERNEL32 ref: 100A1403

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Count64ObjectSingleTickWait
String ID:
API String ID: 3187275320-0
Opcode ID: 1cfadcc898e6b36cfd1a4f7bf5837ebdbe6212e429eb6220fca006c3ac279431
Instruction ID: 1bf18b280d2744a8743e55954746d7a5a9d8936b65fabab63a36412c31ae482f
Opcode Fuzzy Hash: 1cfadcc898e6b36cfd1a4f7bf5837ebdbe6212e429eb6220fca006c3ac279431
Instruction Fuzzy Hash: 1201BC32B092548BC700BEBD9CC845EBBE5FBC41A4F808A3DE988C7705E63098088792

Uniqueness

Uniqueness Score: -1.00%

Function 1001B7E0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

mv_buffer_alloc.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B7F0

Part of subcall function 10009DC0: mv_malloc.MAIN ref: 10009DDC
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009DF2
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009E25

mv_realloc.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B820

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_mallocz.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B836
mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B87F

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$_aligned_reallocmv_buffer_allocmv_buffer_unrefmv_mallocmv_realloc
String ID:
API String ID: 547404713-0
Opcode ID: f53c243b31966ade95df7518ce4c0598c2817321e792378a526fbf3cdf0bd58c
Instruction ID: e87e4f9eabebad2ec55774af977a150987189923fc92643a84a7bc33fe8d3c27
Opcode Fuzzy Hash: f53c243b31966ade95df7518ce4c0598c2817321e792378a526fbf3cdf0bd58c
Instruction Fuzzy Hash: 0011F8B4908B418FD750DF25D48068AFBE4FF48290F55896EE99A9B315EB30E881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1004D9C8 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 1004D9EA
mv_freep.MAIN ref: 1004D9F5
mv_freep.MAIN ref: 1004DA00
mv_freep.MAIN ref: 1004DA0B

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 883756fb135680f02b9e7241d4b82a69b6f557dd1b3e18bc2a7579ac156dc7e8
Instruction ID: a4ea76907e77a494ff592404b92edb11bbb38d68de6f5075056f11605139768e
Opcode Fuzzy Hash: 883756fb135680f02b9e7241d4b82a69b6f557dd1b3e18bc2a7579ac156dc7e8
Instruction Fuzzy Hash: FF1157B5D04B608ADB40EF64E8C135977E4EF05310F5A48BADC85CB38AE739D884C756

Uniqueness

Uniqueness Score: -1.00%

Function 1000E9B1 Relevance: 6.0, APIs: 4, Instructions: 49stringCOMMON

Download Yara Rule

APIs

mv_channel_from_string.MAIN ref: 1000E993
strchr.MSVCRT ref: 1000E9C4
mv_strlcpy.MAIN ref: 1000E9EF

Part of subcall function 100066E0: strlen.MSVCRT ref: 10006726

mv_channel_from_string.MAIN ref: 1000EA01

Part of subcall function 1000C560: strncmp.MSVCRT ref: 1000C582
Part of subcall function 1000C560: strcmp.MSVCRT ref: 1000C5B0

strcmp.MSVCRT ref: 1000EA3D
mv_channel_from_string.MAIN ref: 1000EA58
strcmp.MSVCRT ref: 1000EAA6

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_from_stringstrcmp$mv_strlcpystrchrstrlenstrncmp
String ID:
API String ID: 886603963-0
Opcode ID: 8616275c2150e7efb85d131667853066869ad1c5313a7f24b712379ae3ad5ca6
Instruction ID: 573cd39c050991141a6e921ab4fbfb848e83e1f3f19c3e4a32285acdb0885ff6
Opcode Fuzzy Hash: 8616275c2150e7efb85d131667853066869ad1c5313a7f24b712379ae3ad5ca6
Instruction Fuzzy Hash: AF1136B46087428FDB00DF28C58065ABBE5FF88780F118D2DE5C8EB265E270ED44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 10007050 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

mv_bprint_init.MAIN ref: 10007076
mv_bprint_escape.MAIN ref: 100070AA

Part of subcall function 10009730: mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB

mv_bprint_finalize.MAIN ref: 100070C7

Part of subcall function 10009690: mv_realloc.MAIN(?,?,?,?,?,?,10006D57), ref: 100096C9

mv_bprint_finalize.MAIN ref: 100070F1

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_finalize$mv_bprint_escapemv_bprint_initmv_bprintfmv_realloc
String ID:
API String ID: 2707718180-0
Opcode ID: 8fcf3987ad7d05698dc9ea44ca5edbe39d28e2b760c260b832d1773102fd6b80
Instruction ID: 7786e306f37471b19b8e033861bf3e046f7241f8be26b7eb16500715b45264db
Opcode Fuzzy Hash: 8fcf3987ad7d05698dc9ea44ca5edbe39d28e2b760c260b832d1773102fd6b80
Instruction Fuzzy Hash: 9F116DB4A093408BD360DF28C18065EBBE0BF88254F908E2DBA9C87345E635A944CB06

Uniqueness

Uniqueness Score: -1.00%

Function 1001140B Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10011416
mv_freep.MAIN ref: 10011422

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 7d849d430b18bd63c2ffebc00fb6b84f710c2797a3bf5240d0040ef1fb02228c
Instruction ID: e6160234d2b5473e354702e54758fc74ece171a8690405ef2f617578e500f202
Opcode Fuzzy Hash: 7d849d430b18bd63c2ffebc00fb6b84f710c2797a3bf5240d0040ef1fb02228c
Instruction Fuzzy Hash: B3E0AE79508B608BC700EF28D88141EB7F0FF89208F854C1DFAC4A7306E635F9448B82

Uniqueness

Uniqueness Score: -1.00%

Function 10012B04 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5d3dc0fd0cb3ef6d04f562988a8f745905f1efb17a15ffeb54e2807adc24af
Instruction ID: 8863fbba633440d1c9bb7560d783c2b2fa1c445144d5959f5dcc9319c98cded4
Opcode Fuzzy Hash: ad5d3dc0fd0cb3ef6d04f562988a8f745905f1efb17a15ffeb54e2807adc24af
Instruction Fuzzy Hash: A7E075B9508B508FC744EF64D9C101AB7E0FF8C218F86486CEEC46730AE638F9558B92

Uniqueness

Uniqueness Score: -1.00%

Function 10096CB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 10096D31

Strings

NaN, xrefs: 10096CB1

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: fputc
String ID: NaN
API String ID: 1992160199-1757892521
Opcode ID: 446c0d09ec875dd8de39c76ee9b6d59da228ecf8c121252d4fd607943e324305
Instruction ID: 420e5c579262f8d662284f7d0e655c28558b5f6245a0820502f93f581715481d
Opcode Fuzzy Hash: 446c0d09ec875dd8de39c76ee9b6d59da228ecf8c121252d4fd607943e324305
Instruction Fuzzy Hash: 734107B1B052158BDB10CF18C8C0755B7E1EF89744B2A82A9EC9C9F25AD336ED42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1001F870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Assertion %s failed at %s:%d, xrefs: 1001F99A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_cpu_flags
String ID: Assertion %s failed at %s:%d
API String ID: 185405932-2766368343
Opcode ID: 7551bec9f1eeb9b50cbb3d7bd5363e3c1abd8a109e782f2c9d38e8ffc4970d7f
Instruction ID: 4f99d49389e0e95857478378ad07d1c4ddbe0ca0cbe19b611fff2a9fa084b9f8
Opcode Fuzzy Hash: 7551bec9f1eeb9b50cbb3d7bd5363e3c1abd8a109e782f2c9d38e8ffc4970d7f
Instruction Fuzzy Hash: 27410575A083419FC700DF58C18162EFBF1FF95740F91892DE9895B311D7B6EA858B42

Uniqueness

Uniqueness Score: -1.00%

Function 1001F9D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1001FAC1
abort.MSVCRT ref: 1001FAC6

Strings

Assertion %s failed at %s:%d, xrefs: 1001FAB0

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_log
String ID: Assertion %s failed at %s:%d
API String ID: 2075109169-2766368343
Opcode ID: 99925a3dfaecbcafd95e37379194f54048025d468bd88c2924350edf8c5203d4
Instruction ID: 863fd428840cd462da4e804408d77d29575e174ab1a66922a4b6ae8ce10ff121
Opcode Fuzzy Hash: 99925a3dfaecbcafd95e37379194f54048025d468bd88c2924350edf8c5203d4
Instruction Fuzzy Hash: 3D317CB5A083418BC714CF10C58112EFBE2FFE1650F96895DE98E4B241D7BAE984DB43

Uniqueness

Uniqueness Score: -1.00%

Function 1001F6A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

mv_image_get_linesize.MAIN ref: 1001F6E3

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

Strings

Picture size %ux%u is invalid, xrefs: 1001F76D

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_get_linesizemv_pix_fmt_desc_get
String ID: Picture size %ux%u is invalid
API String ID: 645864070-1963597007
Opcode ID: bffdba0522676a7119fbd8fb8b2c8a2483aa10af2a0b965411779b3daaf4d02a
Instruction ID: 48c45da9e3d96b5e90a1d1455c756ac50fe1bc564d21c4e887ebdd33d9096bef
Opcode Fuzzy Hash: bffdba0522676a7119fbd8fb8b2c8a2483aa10af2a0b965411779b3daaf4d02a
Instruction Fuzzy Hash: 51213D75A083558FC304CF69C08021EFBE1FBC8710F658A2EF99897390EBB1E9458B46

Uniqueness

Uniqueness Score: -1.00%

Function 1002E160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002E173
mv_parse_video_size.MAIN ref: 1002E203

Strings

none, xrefs: 1002E16A

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_parse_video_sizestrcmp
String ID: none
API String ID: 3218284479-2140143823
Opcode ID: 84f624393dde609fecd91fcb81b813e84baa12488068a8de4cf90aaac65596b6
Instruction ID: 729e6b95738b9364faedc3518f6085fbd91f0b578ed6da749226210f4fcd2ad2
Opcode Fuzzy Hash: 84f624393dde609fecd91fcb81b813e84baa12488068a8de4cf90aaac65596b6
Instruction Fuzzy Hash: C501AF756493819BC780DF28E58141ABBE0EF88780FD58C3EB999C7611E734ED50DB52

Uniqueness

Uniqueness Score: -1.00%

Function 1002B91C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002B989

Strings

The value for option '%s' is not a %s format., xrefs: 1002B963
sample, xrefs: 1002B979

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: The value for option '%s' is not a %s format.$sample
API String ID: 2835281190-3983800382
Opcode ID: f49712ef087a5300012602a4ae27b8686ff3b490cfd8fc097ffab49afbc0abb3
Instruction ID: 33a2e8cedfd6eb5c178779c30063465e0d9992998a3643eadf349b9b06bba310
Opcode Fuzzy Hash: f49712ef087a5300012602a4ae27b8686ff3b490cfd8fc097ffab49afbc0abb3
Instruction Fuzzy Hash: 1F01A278608B418FC750CF29D080A1BB7F1FB8A350F91892DFA998B351D735ED859B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002BA22 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_channel_layout_copy.MAIN ref: 1002BA6D
mv_log.MAIN ref: 1002BAA1

Strings

The value for option '%s' is not a channel layout., xrefs: 1002BA88

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_channel_layout_copymv_log
String ID: The value for option '%s' is not a channel layout.
API String ID: 3662905369-3477801521
Opcode ID: 63eae10e1faf95874b39526640df72a371b18a35267310b0c8889e7638938ea1
Instruction ID: 86c0ab47ef858223f00db33ddf4d2f1872dd7c29670028b1578f074587e6d610
Opcode Fuzzy Hash: 63eae10e1faf95874b39526640df72a371b18a35267310b0c8889e7638938ea1
Instruction Fuzzy Hash: EB01AE78A097019FC794DF29D480A1EB7E1FF88750F81892DF8D987351EA34E9449B83

Uniqueness

Uniqueness Score: -1.00%

Function 1002B8A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002B909

Strings

The value for option '%s' is not a %s format., xrefs: 1002B8E3
pixel, xrefs: 1002B8F9

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: The value for option '%s' is not a %s format.$pixel
API String ID: 2835281190-1801304947
Opcode ID: 1afb6f9e1294010d39633e90c64ba35938d2ef3760f720932574ff8c187a9bcd
Instruction ID: 81a977f13b7eab3a7f73a45e2267e6bafa0d1da5cfeb87ddfd4a13f4960ac526
Opcode Fuzzy Hash: 1afb6f9e1294010d39633e90c64ba35938d2ef3760f720932574ff8c187a9bcd
Instruction Fuzzy Hash: 0B01A2786087418FC340CF29D08091AB7F1FBC9250F91892EE99887351D735DD859B42

Uniqueness

Uniqueness Score: -1.00%

Function 1000C461 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

mv_bprint_init_for_buffer.MAIN ref: 1000C4A8
mv_bprintf.MAIN ref: 1000C4D0

Strings

none, xrefs: 1000C4C7

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init_for_buffermv_bprintf
String ID: none
API String ID: 2490314137-2140143823
Opcode ID: 44bfa67158831aa083f8cc1da789653ca32cdf6bd98319aefa498c906f6f28ff
Instruction ID: ef26fa46dfb025d24f9aeb391b3245028a50c27fa559dbd60d9f836e91f94d6c
Opcode Fuzzy Hash: 44bfa67158831aa083f8cc1da789653ca32cdf6bd98319aefa498c906f6f28ff
Instruction Fuzzy Hash: E60136B5904B568BD720DF24D880B9BB3E4FFC4394F52492DEA9853245D330BD858B97

Uniqueness

Uniqueness Score: -1.00%

Function 1002B099 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 1002AE5C

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_get_pix_fmt_name.MAIN ref: 1002B0A5

Strings

none, xrefs: 1002B08C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _aligned_reallocmv_get_pix_fmt_namemv_strdupstrlen
String ID: none
API String ID: 2695740210-2140143823
Opcode ID: 1bdfb643ea00e6ad6df9396137144eb3072052bb604228f3ba1a7f9353facca7
Instruction ID: 0d6bc99ecbd7f612be6a0bf6eac545e310f060afd60664256324de9b27112373
Opcode Fuzzy Hash: 1bdfb643ea00e6ad6df9396137144eb3072052bb604228f3ba1a7f9353facca7
Instruction Fuzzy Hash: 9EF0B6785087518FD760DB64945075EB7E0FF88300FA1882AED98A7301E634E9559B92

Uniqueness

Uniqueness Score: -1.00%

Function 1002B079 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 1002AE5C

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_get_sample_fmt_name.MAIN ref: 1002B085

Strings

none, xrefs: 1002B08C

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _aligned_reallocmv_get_sample_fmt_namemv_strdupstrlen
String ID: none
API String ID: 2802023675-2140143823
Opcode ID: 69058493cd3c9ad5c8ca340b2f5a7719628deb832772a771e9d99c4ade640db3
Instruction ID: 5fee32d5547f3127f63c377983f0a0c76c391dad5c7b300539e2ac3540c0e873
Opcode Fuzzy Hash: 69058493cd3c9ad5c8ca340b2f5a7719628deb832772a771e9d99c4ade640db3
Instruction Fuzzy Hash: 0DF0B2785087518FD760DB24E84075EB7E0EB88200FA1882AE9C8A7301EA34E9558B92

Uniqueness

Uniqueness Score: -1.00%

Function 10012408 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

mv_strlcatf.MAIN ref: 10012429

Part of subcall function 100067F0: strlen.MSVCRT ref: 1000680A

mv_dict_set.MAIN ref: 1001244D

Strings

.%06dZ, xrefs: 10012419

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_setmv_strlcatfstrlen
String ID: .%06dZ
API String ID: 1014950348-3752268379
Opcode ID: 0fcd152bd701cbbf5cc4896f3278894f4415348b4f9091eae84d680c15830739
Instruction ID: 22fa46e81f10ce603b991d120468da5a27ef3793c7905e7972ce2945146385a5
Opcode Fuzzy Hash: 0fcd152bd701cbbf5cc4896f3278894f4415348b4f9091eae84d680c15830739
Instruction Fuzzy Hash: 4BE04EB5908740AFD714DF29E48175ABBE0FB88354F51C82EA49CD7306D63898518B46

Uniqueness

Uniqueness Score: -1.00%

Function 1001E474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

mv_image_check_size.MAIN ref: 1001E4BA
mv_calloc.MAIN ref: 1001E519
mv_frame_alloc.MAIN ref: 1001E584
mv_frame_free.MAIN ref: 1001E5CB
mv_freep.MAIN ref: 1001E5DC
mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Strings

The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_callocmv_frame_allocmv_frame_freemv_freepmv_get_pix_fmt_namemv_image_check_sizemv_log
String ID: The hardware pixel format '%s' is not supported by the device type '%s'
API String ID: 473889652-379977042
Opcode ID: f3e8bdb9d7c170bdc459c1ee668fdc6473492807cb8fec2a19448897106cc44b
Instruction ID: 2c6a83db8df34ec64cc29cb3759a8fadaa61080bb751505f1c4c7e836789d21e
Opcode Fuzzy Hash: f3e8bdb9d7c170bdc459c1ee668fdc6473492807cb8fec2a19448897106cc44b
Instruction Fuzzy Hash: A2F022786047418FC710DF29C08051EBBE0EB4D760F558A5DEAE99B391D774EC809B92

Uniqueness

Uniqueness Score: -1.00%

Function 1001E644 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Strings

The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_pix_fmt_namemv_log
String ID: The hardware pixel format '%s' is not supported by the device type '%s'
API String ID: 3418758923-379977042
Opcode ID: 29ee3040ede78108e4cc3fd02deb21ab80279a55efe4e481cb1b1b588cc07577
Instruction ID: 525b23ace38b9bb6834e06c5e8b4b181dd8ba8557f5f50a91c42102dc809ce23
Opcode Fuzzy Hash: 29ee3040ede78108e4cc3fd02deb21ab80279a55efe4e481cb1b1b588cc07577
Instruction Fuzzy Hash: 36E02DB89187409FC710DF29808121EBBE0FB49710F51CD2EA9E89B341D774E8809B82

Uniqueness

Uniqueness Score: -1.00%

Function 100A32F0 Relevance: 5.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,100A251B), ref: 100A3336
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000,?,100A251B), ref: 100A33C6

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4e649fb5589839585a3db9129e011a102968486331968e4d623d8a606afbd6b6
Instruction ID: cd97afb910d891c998fc8f4c8da6addb25bd49834f2ec99f6cb4ecbf8d1de135
Opcode Fuzzy Hash: 4e649fb5589839585a3db9129e011a102968486331968e4d623d8a606afbd6b6
Instruction Fuzzy Hash: 0D317CB2A08200CFDB44EF68D9C465ABBE0FF44354F048269FC058F249EB75DA85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100A30A0 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000014,-0000001C,00000018,100A3371), ref: 100A30C0
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000,00000014,-0000001C,00000018,100A3371), ref: 100A30DC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000014,-0000001C,00000018,100A3371), ref: 100A3119
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000014,-0000001C,00000018,100A3371), ref: 100A3125

Memory Dump Source

Source File: 00000004.00000002.382004815.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.381999738.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382098616.00000000100AA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382108966.00000000100AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382129916.00000000101D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382138593.00000000101DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101DE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382142749.00000000101E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.382161529.00000000101FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f1c14836da530fe9eca5c2f1fe85ea188205922fc14795e91c327708d0793e06
Instruction ID: 8d8f9149d6a0c4a1080b13f3e35a8b2e82ad2259457e814be12ca506ec95b23d
Opcode Fuzzy Hash: f1c14836da530fe9eca5c2f1fe85ea188205922fc14795e91c327708d0793e06
Instruction Fuzzy Hash: 171103B5A093219FC300EF79E98550EBBF0EF89661F02492DE98887311D231E848CB93

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5q4psw.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\55f8bb.rbs

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

C:\Windows\Installer\55f8ba.msi

C:\Windows\Installer\55f8bc.msi

C:\Windows\Installer\MSIFB1B.tmp

C:\Windows\Installer\SourceHash{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF092DC5D1FEAA268C.TMP

C:\Windows\Temp\~DF3AFD14CAA7749B80.TMP

C:\Windows\Temp\~DF3F77F918320563FF.TMP

C:\Windows\Temp\~DF4A6271EF11B37377.TMP

C:\Windows\Temp\~DF5555397D86C72808.TMP

C:\Windows\Temp\~DFA48F4C3EB3ED2F6F.TMP

C:\Windows\Temp\~DFB2E09CA8BE461258.TMP

Windows Analysis Report
5q4psw.msi

Function 1002A4FB Relevance: 1.5, APIs: 1, Instructions: 19
memoryCOMMON

Function 1002A61E Relevance: 1.3, APIs: 1, Instructions: 75
memoryCOMMON

Function 1002A4E1 Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Function 1000D4D0 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 306
COMMONCrypto

Function 100132D0 Relevance: 28.6, APIs: 19, Instructions: 136
COMMON

Function 1002DCE0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 252
stringCOMMONCrypto

Function 10020830 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 634
COMMONCrypto