Edit tour

Windows Analysis Report
setup.msi

Overview

General Information

Sample name:	setup.msi
Analysis ID:	1591980
MD5:	fc2fca2711e9ff2c2d5919f4c27cd1a1
SHA1:	1d0a411878f9ebc1c5c7da1b2fe812c295a37cbd
SHA256:	52341adb87a5e79d06901a64002c494e3f431c378193982c30225eab3b136688
Tags:	LegionLoadermsiRobotDropperstaticmaxepress-comuser-aachum
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

AI detected suspicious sample

Bypasses PowerShell execution policy

Potentially malicious time measurement code found

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Msiexec Initiated Connection

Sigma detected: Suspicious MsiExec Embedding Parent

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected AdvancedInstaller

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 2408 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\setup.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6460 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2888 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 6552 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

obs-ffmpeg-mux.exe (PID: 1292 cmdline: "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe" MD5: D3CAC4D7B35BACAE314F48C374452D71)

conhost.exe (PID: 6020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

createdump.exe (PID: 2164 cmdline: "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe" MD5: 71F796B486C7FAF25B9B16233A7CE0CD)

conhost.exe (PID: 3292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AdvancedInstaller	Yara detected AdvancedInstaller	Joe Security

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 2888, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 6552, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 2888, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 6552, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 2888, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 6552, ProcessName: powershell.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 2888, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 2888, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 6552, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T16:10:28.604111+0100	2829202	1	A Network Trojan was detected	192.168.2.5	49704	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://staticmaxepress.com/updater2.php

Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.5% probability

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8373D77F-FFF1-454F-A9BC-057E48DE9D80}

Jump to behavior

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: createdump.exe, 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp, createdump.exe, 00000008.00000000.2292812193.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb= source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb)) source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: ucrtbase.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbk source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: Microsoft.Web.WebView2.Core.pdbGCTL source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcamp140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vccorlib140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\msvcp140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcomp140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb!! source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: api-ms-win-core-errorhandling-l1-1-0.dll.1.dr
Source:	Binary string: C:\a\_work\1\s\BuildOutput\Release\x86\Microsoft.UI.Xaml\Microsoft.UI.Xaml.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\vcruntime140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: api-ms-win-core-file-l1-1-0.dll.1.dr
Source:	Binary string: obs-ffmpeg-mux.pdb source: obs-ffmpeg-mux.exe, 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmp, obs-ffmpeg-mux.exe, 00000007.00000000.2292786392.00007FF65EE15000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb;;;GCTL source: createdump.exe, 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp, createdump.exe, 00000008.00000000.2292812193.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: Microsoft.Web.WebView2.Core.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: ucrtbase.pdbUGP source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: w32-pthreads.pdb source: obs-ffmpeg-mux.exe, 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: setup.msi, MSI778F.tmp.1.dr, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: setup.msi, 4c6f16.msi.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 4x nop then push rbx

7_2_00007FF8A7DD46C0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.5:49704 -> 188.114.96.3:443

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: staticmaxepress.com

Source: unknown

HTTP traffic detected: POST /updater2.php HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AdvancedInstallerHost: staticmaxepress.comContent-Length: 71Cache-Control: no-cache

Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: powershell.exe, 00000004.00000002.2236454578.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: swresample-4.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0K
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: obs-ffmpeg-mux.exe, obs-ffmpeg-mux.exe, 00000007.00000002.2295394041.00007FF8A4C7B000.00000002.00000001.01000000.0000000A.sdmp, avformat-60.dll.1.dr	String found in binary or memory: http://dashif.org/guidelines/trickmode
Source: powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: setup.msi, avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, 4c6f16.msi.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000004.00000002.2237085575.0000000004987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: http://schemas.mici
Source: powershell.exe, 00000004.00000002.2237085575.0000000004831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: obs-ffmpeg-mux.exe, 00000007.00000002.2295394041.00007FF8A4C7B000.00000002.00000001.01000000.0000000A.sdmp, avformat-60.dll.1.dr	String found in binary or memory: http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd
Source: powershell.exe, 00000004.00000002.2237085575.0000000004987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: setup.msi, avformat-60.dll.1.dr, zlib.dll.1.dr, swresample-4.dll.1.dr, 4c6f16.msi.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: obs-ffmpeg-mux.exe, 00000007.00000002.2298547245.00007FF8A6E50000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: zlib.dll.1.dr	String found in binary or memory: http://www.zlib.net/D
Source: powershell.exe, 00000004.00000002.2237085575.0000000004831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: https://aka.ms/winui2/webview2download/Reload():
Source: powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2237085575.0000000004987000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2237085575.0000000004EF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: https://staticmaxepress.com/updater2.phpx
Source: obs-ffmpeg-mux.exe, obs-ffmpeg-mux.exe, 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://streams.videolan.org/upload/
Source: setup.msi, 4c6f16.msi.1.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4c6f13.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI778F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77FE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI783D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI786D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI78AD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI790B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI793B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9715.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{8373D77F-FFF1-454F-A9BC-057E48DE9D80}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D30.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D31.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4c6f16.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4c6f16.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI778F.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF65EE12A10	7_2_00007FF65EE12A10
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF65EE12EE0	7_2_00007FF65EE12EE0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B8D0	7_2_00007FF8A7D5B8D0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5D8D0	7_2_00007FF8A7D5D8D0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D828B0	7_2_00007FF8A7D828B0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7DD4840	7_2_00007FF8A7DD4840
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5E820	7_2_00007FF8A7D5E820
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D76820	7_2_00007FF8A7D76820
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D787F0	7_2_00007FF8A7D787F0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B790	7_2_00007FF8A7D5B790
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D51730	7_2_00007FF8A7D51730
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5D700	7_2_00007FF8A7D5D700
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B6A0	7_2_00007FF8A7D5B6A0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7E00640	7_2_00007FF8A7E00640
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D7C650	7_2_00007FF8A7D7C650
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B5C0	7_2_00007FF8A7D5B5C0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5D5C0	7_2_00007FF8A7D5D5C0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D73580	7_2_00007FF8A7D73580
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D93560	7_2_00007FF8A7D93560
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5A520	7_2_00007FF8A7D5A520
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5E4C0	7_2_00007FF8A7D5E4C0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D944D0	7_2_00007FF8A7D944D0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D724D0	7_2_00007FF8A7D724D0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B460	7_2_00007FF8A7D5B460
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D733E0	7_2_00007FF8A7D733E0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D513A0	7_2_00007FF8A7D513A0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B380	7_2_00007FF8A7D5B380
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D95350	7_2_00007FF8A7D95350
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D96350	7_2_00007FF8A7D96350
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D94330	7_2_00007FF8A7D94330
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5C2F0	7_2_00007FF8A7D5C2F0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D7F2C0	7_2_00007FF8A7D7F2C0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D57260	7_2_00007FF8A7D57260
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5D210	7_2_00007FF8A7D5D210
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5C1A0	7_2_00007FF8A7D5C1A0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5A1B0	7_2_00007FF8A7D5A1B0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D81160	7_2_00007FF8A7D81160
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B150	7_2_00007FF8A7D5B150
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D830A0	7_2_00007FF8A7D830A0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5B030	7_2_00007FF8A7D5B030
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5D030	7_2_00007FF8A7D5D030
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D72F20	7_2_00007FF8A7D72F20
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5DEF0	7_2_00007FF8A7D5DEF0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D56E70	7_2_00007FF8A7D56E70
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5BE20	7_2_00007FF8A7D5BE20
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D91E10	7_2_00007FF8A7D91E10
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D6FDF0	7_2_00007FF8A7D6FDF0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D82D90	7_2_00007FF8A7D82D90
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D59D50	7_2_00007FF8A7D59D50
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D72D20	7_2_00007FF8A7D72D20
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5CCE0	7_2_00007FF8A7D5CCE0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D92CC0	7_2_00007FF8A7D92CC0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D74C80	7_2_00007FF8A7D74C80
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D51C30	7_2_00007FF8A7D51C30
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D83C00	7_2_00007FF8A7D83C00
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D9CBE0	7_2_00007FF8A7D9CBE0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D72BF0	7_2_00007FF8A7D72BF0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7DB2B80	7_2_00007FF8A7DB2B80
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D53B87	7_2_00007FF8A7D53B87
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D92B60	7_2_00007FF8A7D92B60
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D82B40	7_2_00007FF8A7D82B40
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D95B00	7_2_00007FF8A7D95B00
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7DFDAA0	7_2_00007FF8A7DFDAA0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5BA70	7_2_00007FF8A7D5BA70
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D59A50	7_2_00007FF8A7D59A50
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D599C0	7_2_00007FF8A7D599C0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5E9A0	7_2_00007FF8A7D5E9A0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D5D9B0	7_2_00007FF8A7D5D9B0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D809B0	7_2_00007FF8A7D809B0
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D75980	7_2_00007FF8A7D75980
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D51990	7_2_00007FF8A7D51990
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8A7D84920	7_2_00007FF8A7D84920

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: String function: 00007FF8A7D756C0 appears 288 times

Source: avcodec-60.dll.1.dr	Static PE information: Number of sections : 13 > 10
Source: avutil-58.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: swresample-4.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: swscale-7.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: zlib.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: avformat-60.dll.1.dr	Static PE information: Number of sections : 12 > 10

Source: api-ms-win-core-handle-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found

Source: setup.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenameDataUploader.dllF vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenameucrtbase.dllj% vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenamevcruntime140.dllT vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenamemsvcp140.dllT vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenameMicrosoft.Web.WebView2.Core.dll vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenameMicrosoft.UI.Xaml.dllD vs setup.msi
Source: setup.msi	Binary or memory string: OriginalFilenameembeddeduiproxy.dllF vs setup.msi

Source: classification engine

Classification label: mal76.evad.winMSI@13/88@1/1

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLA6CD.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFF3C7A797E5A0F76F.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: obs-ffmpeg-mux.exe	String found in binary or memory: #EXT-X-START value isinvalid, it will be ignored
Source: obs-ffmpeg-mux.exe	String found in binary or memory: #EXT-X-START:
Source: obs-ffmpeg-mux.exe	String found in binary or memory: prefer to use #EXT-X-START if it's in playlist instead of live_start_index
Source: obs-ffmpeg-mux.exe	String found in binary or memory: start/stop audio
Source: obs-ffmpeg-mux.exe	String found in binary or memory: start/stop audio

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\setup.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe"
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: obs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: avcodec-60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: avutil-58.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: avformat-60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: w32-pthreads.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: avutil-58.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: swresample-4.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8373D77F-FFF1-454F-A9BC-057E48DE9D80}

Jump to behavior

Source: setup.msi

Static file information: File size 60619566 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: createdump.exe, 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp, createdump.exe, 00000008.00000000.2292812193.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb= source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb)) source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: ucrtbase.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbk source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: Microsoft.Web.WebView2.Core.pdbGCTL source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbm source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcamp140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vccorlib140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\WinUiBootstrapperEui\WinUiBootstrapperEui.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\msvcp140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: api-ms-win-core-synch-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source:	Binary string: E:\BA\201\s\140_release\vcrt_fwd_x86_release\Release\vcomp140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb!! source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: api-ms-win-core-errorhandling-l1-1-0.dll.1.dr
Source:	Binary string: C:\a\_work\1\s\BuildOutput\Release\x86\Microsoft.UI.Xaml\Microsoft.UI.Xaml.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\140_release\vcrt_fwd_x86_release\Release\vcruntime140_app.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: api-ms-win-core-file-l1-1-0.dll.1.dr
Source:	Binary string: obs-ffmpeg-mux.pdb source: obs-ffmpeg-mux.exe, 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmp, obs-ffmpeg-mux.exe, 00000007.00000000.2292786392.00007FF65EE15000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\s\Win32\Release\Microsoft.Toolkit.Win32.UI.XamlApplication\Microsoft.Toolkit.Win32.UI.XamlHost.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb;;;GCTL source: createdump.exe, 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp, createdump.exe, 00000008.00000000.2292812193.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: Microsoft.Web.WebView2.Core.pdb source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: ucrtbase.pdbUGP source: setup.msi, 4c6f16.msi.1.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.1.dr
Source:	Binary string: w32-pthreads.pdb source: obs-ffmpeg-mux.exe, 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: setup.msi, MSI778F.tmp.1.dr, 4c6f16.msi.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: setup.msi, 4c6f16.msi.1.dr

Source: api-ms-win-core-synch-l1-2-0.dll.1.dr

Static PE information: 0x8A188CB0 [Tue Jun 2 13:31:28 2043 UTC]

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7D6ED32 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,

7_2_00007FF8A7D6ED32

Source: vcruntime140.dll.1.dr	Static PE information: section name: _RDATA
Source: BCUninstaller.exe.1.dr	Static PE information: section name: _RDATA
Source: createdump.exe.1.dr	Static PE information: section name: _RDATA
Source: UnRar.exe.1.dr	Static PE information: section name: _RDATA
Source: avformat-60.dll.1.dr	Static PE information: section name: .xdata
Source: avutil-58.dll.1.dr	Static PE information: section name: .xdata
Source: swresample-4.dll.1.dr	Static PE information: section name: .xdata
Source: swscale-7.dll.1.dr	Static PE information: section name: .xdata
Source: zlib.dll.1.dr	Static PE information: section name: .xdata
Source: avcodec-60.dll.1.dr	Static PE information: section name: .rodata
Source: avcodec-60.dll.1.dr	Static PE information: section name: .xdata
Source: MSI9D31.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI778F.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI77FE.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI783D.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI786D.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI78AD.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI790B.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI793B.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI9715.tmp.1.dr	Static PE information: section name: .fptable

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_068BBD76 push esp; ret

4_2_068BBD93

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avformat-60.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\w32-pthreads.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9715.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI793B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI783D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avutil-58.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\UnRar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swscale-7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI78AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\zlib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D31.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI786D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avcodec-60.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI790B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77FE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swresample-4.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\BCUninstaller.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI778F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI78AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9715.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI790B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI77FE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI793B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D31.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI783D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI778F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI786D.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7D6B840 FreeLibrary,free,calloc,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryExW,_aligned_free,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,_errno,GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryExA,FreeLibrary,free,wcslen,GetModuleFileNameW,_aligned_free,_aligned_free,_aligned_free,wcscpy,LoadLibraryExW,LoadLibraryExW,_aligned_free,_aligned_free,_aligned_free,_aligned_free,_aligned_free,_aligned_free,_aligned_free,GetSystemDirectoryW,GetSystemDirectoryW,GetSystemDirectoryW,wcscpy,LoadLibraryExW,_aligned_free,_aligned_free,_aligned_free,_aligned_free,

7_2_00007FF8A7D6B840

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7D82D90 rdtsc

7_2_00007FF8A7D82D90

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2735			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1859			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swscale-7.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI78AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9715.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\zlib.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI793B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9D31.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI783D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI786D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\msvcp140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI790B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI77FE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\BCUninstaller.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI778F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\UnRar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe

API coverage: 8.2 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6480	Thread sleep count: 2735 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep count: 1859 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 4c6f16.msi.1.dr	Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: obs-ffmpeg-mux.exe, 00000007.00000002.2298547245.00007FF8A6A3A000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Video @
Source: obs-ffmpeg-mux.exe, 00000007.00000002.2298547245.00007FF8A6A3A000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: VMware Screen Codec / VMware Video

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7D82D90 Start: 00007FF8A7D8300F End: 00007FF8A7D82E85

7_2_00007FF8A7D82D90

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7D82D90 rdtsc

7_2_00007FF8A7D82D90

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF65EE13C5C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00007FF65EE13C5C

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7D6ED32 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,

7_2_00007FF8A7D6ED32

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe "C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe"

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF65EE13E04 SetUnhandledExceptionFilter,	7_2_00007FF65EE13E04
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF65EE13774 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF65EE13774
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF65EE13C5C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF65EE13C5C
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8BFAB6CBC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8BFAB6CBC
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	Code function: 7_2_00007FF8BFAB6710 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8BFAB6710
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Code function: 8_2_00007FF71BAA2ECC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF71BAA2ECC
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Code function: 8_2_00007FF71BAA3074 SetUnhandledExceptionFilter,	8_2_00007FF71BAA3074
Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	Code function: 8_2_00007FF71BAA2984 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF71BAA2984

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."

Source: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pss9de7.ps1" -propfile "c:\users\user\appdata\local\temp\msi9dd4.txt" -scriptfile "c:\users\user\appdata\local\temp\scr9dd5.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scr9dd6.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pss9de7.ps1" -propfile "c:\users\user\appdata\local\temp\msi9dd4.txt" -scriptfile "c:\users\user\appdata\local\temp\scr9dd5.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scr9dd6.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF65EE13B40 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_00007FF65EE13B40

Source: C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Code function: 7_2_00007FF8A7DF9720 GetTimeZoneInformation,GetSystemTimeAsFileTime,

7_2_00007FF8A7DF9720

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	21 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\BCUninstaller.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\UnRar.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avcodec-60.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avformat-60.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avutil-58.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swresample-4.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swscale-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\w32-pthreads.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\zlib.dll	0%	ReversingLabs
C:\Windows\Installer\MSI778F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI77FE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI783D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI786D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI78AD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI790B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI793B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9715.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9D31.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://staticmaxepress.com/updater2.php	100%	Avira URL Cloud	malware
https://staticmaxepress.com/updater2.phpx	0%	Avira URL Cloud	safe
http://schemas.mici	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
staticmaxepress.com	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://staticmaxepress.com/updater2.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000004.00000002.2236454578.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2237085575.0000000004987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://streams.videolan.org/upload/	obs-ffmpeg-mux.exe, obs-ffmpeg-mux.exe, 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.2237085575.0000000004831000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2237085575.0000000004987000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zlib.net/D	zlib.dll.1.dr	false		high
https://go.micro	powershell.exe, 00000004.00000002.2237085575.0000000004EF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.videolan.org/x264.html	obs-ffmpeg-mux.exe, 00000007.00000002.2298547245.00007FF8A6E50000.00000002.00000001.01000000.00000008.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dashif.org/guidelines/trickmode	obs-ffmpeg-mux.exe, obs-ffmpeg-mux.exe, 00000007.00000002.2295394041.00007FF8A4C7B000.00000002.00000001.01000000.0000000A.sdmp, avformat-60.dll.1.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2239446716.0000000005898000.00000004.00000800.00020000.00000000.sdmp	false		high
http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd	obs-ffmpeg-mux.exe, 00000007.00000002.2295394041.00007FF8A4C7B000.00000002.00000001.01000000.0000000A.sdmp, avformat-60.dll.1.dr	false		high
http://schemas.mici	setup.msi, 4c6f16.msi.1.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/winui2/webview2download/Reload():	setup.msi, 4c6f16.msi.1.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2237085575.0000000004831000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2237085575.0000000004987000.00000004.00000800.00020000.00000000.sdmp	false		high
https://staticmaxepress.com/updater2.phpx	setup.msi, 4c6f16.msi.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	staticmaxepress.com	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591980
Start date and time:	2025-01-15 16:09:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.msi
Detection:	MAL
Classification:	mal76.evad.winMSI@13/88@1/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 214
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target obs-ffmpeg-mux.exe, PID 1292 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6552 because it is empty
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
10:10:29	API Interceptor	4x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	http://www.brillflooring.com	Get hash	malicious	Unknown	Browse	www.brillflooring.com/
	New Order#12125.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	CSZ inquiry for MH raw material.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	1001-13.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/pgw3/
	trow.exe	Get hash	malicious	Unknown	Browse	www.tc17.com/
	HN1GiQ5tF7.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	AxKxwW9WGa.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	XeFYBYYj0w.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/8g74/?wtE0B=1LjxZz&9F=WJ/rFpSuW7SUTonvHlYgJHet70+40/nSG+S456FFT70GKpWTD+yYW7KPXc3l6inPZ41lXlQU44ttBNcSIyPO/Awb2QEZq+eieNEXwOjUfdTJHvICblirwfj54bAbpLWz76fPuJmn0JFO
	tfWjjV1LdT.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	M7XS5C07kV.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
staticmaxepress.com	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.162.17
	setup.msi	Get hash	malicious	Unknown	Browse	172.67.162.17
	Setup.msi	Get hash	malicious	Unknown	Browse	104.21.34.147

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Qj9gUbJBkY.dll	Get hash	malicious	Wannacry	Browse	8.44.41.1
	xd.spc.elf	Get hash	malicious	Mirai	Browse	172.69.125.196
	http://www.mcpf.co.za	Get hash	malicious	Unknown	Browse	104.17.25.14
	MotivatedFunded.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.135.233
	Set-Up.exe	Get hash	malicious	LummaC	Browse	104.21.75.15
	http://www.mcpf.co.za	Get hash	malicious	Unknown	Browse	104.17.25.14
	ActiVe_Ver_Set-UpFilE.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.192.161
	Personliche Nachricht fur e4060738.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpshieldnemt.com%2525252Fwp%25252FGnrm%25252FJ6y6AQ%25252FAQ%25252Fe40c43dd-851b-4580-9323-fb61c1f4e855%25252F1%25252FDz8wyx-xnG%252FGnrm%252FK6y6AQ%252FAQ%252F08a87d58-9017-42a2-87a2-16d811ad0020%252F1%252FAQhuEqjtZr%2FGnrm%2FLKy6AQ%2FAQ%2Ff082e7c9-7f04-4f29-b74f-bf5134bab4b2%2F1%2F6eo6CGyRlQ/Gnrm/Lay6AQ/AQ/e23803d3-ac37-4b0c-9ec4-0cf79f1109e9/1/9Hx062h64U#d2F0c29uLmJlY2t5QGFpZGIub3Jn	Get hash	malicious	Phisher	Browse	172.66.0.235
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpshieldnemt.com%2525252Fwp%25252FGnrm%25252FJ6y6AQ%25252FAQ%25252Fe40c43dd-851b-4580-9323-fb61c1f4e855%25252F1%25252FDz8wyx-xnG%252FGnrm%252FK6y6AQ%252FAQ%252F08a87d58-9017-42a2-87a2-16d811ad0020%252F1%252FAQhuEqjtZr%2FGnrm%2FLKy6AQ%2FAQ%2Ff082e7c9-7f04-4f29-b74f-bf5134bab4b2%2F1%2F6eo6CGyRlQ/Gnrm/Lay6AQ/AQ/e23803d3-ac37-4b0c-9ec4-0cf79f1109e9/1/9Hx062h64U#d2F0c29uLmJlY2t5QGFpZGIub3Jn	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	188.114.96.3
	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	188.114.96.3
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	188.114.96.3
	138745635-72645747.116.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	2834573-3676874985.02.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	regsvr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	188.114.96.3
	1KaTo6P18Z.doc	Get hash	malicious	Unknown	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\UnRar.exe	K064a7Rfk7.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	u1XWB0BIju.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	6a7e35.msi	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\BCUninstaller.exe	K064a7Rfk7.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	u1XWB0BIju.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	6a7e35.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\4c6f15.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	19799
Entropy (8bit):	5.833355000167904
Encrypted:	false
SSDEEP:	384:XYl2sOat1wdvHEJV/tmlkkm+mN/Cit8G4Dv2ejnxZ4UnrcoWVj9CUNGRf8w/8wsT:XQ2sOat1wdvHEJV/tmlkkm+mN/Cit8GF
MD5:	B8529E4CE051D9BFA054755FCFE56A4B
SHA1:	8825FAF2500813976F77CADB5C0AFB2461AA5B8C
SHA-256:	5F930F52A0E11259B2A19E346A02122C7252C0DD94C0CDBECF72F112D92ACA2B
SHA-512:	12AEF9C1B4C27F1C028C1C3E72EF9C5EF27E3B6624513BA9285FD94EC817E4366683A10EE94E328F137FA682BB92C6B9FCFD90A6C68A416D8F6DFF2D0584C173
Malicious:	false
Preview:	...@IXOS.@.....@PQ/Z.@.....@.....@.....@.....@.....@......&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}..Joas App..setup.msi.@.....@.....@.....@......icon_31.exe..&.{B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}.....@.....@.....@.....@.......@.....@.....@.......@......Joas App......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{F39C344E-A83E-4760-8DA8-F27602095B4F}&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}.@......&.{BC83E781-7DE2-47A8-97C3-2E6CC9BCAD82}&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}.@......&.{279C32E3-A00A-4513-9A8B-D3984A41A6FB}&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}.@......&.{B61B35E4-8BE1-4171-B69B-E2423CE9179F}&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}.@......&.{FDDB96EE-847D-4B25-85B1-65E662CF63A8}&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}.@......&.{9608D8ED-8EC6-4540-B232-4A823606F862}&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}.@......&.{17B6E8D6-C004-40DB-BB2D-125D7C1CC21E}&.{8373D77F-FFF1-454F-A

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.415059038751397
Encrypted:	false
SSDEEP:	24:3Uyt3WSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NK3R82r+SVbR:ky9WSU4xymI4RfoUeW+mZ9tK8NWR82jD
MD5:	FD6EFA8F14C5DC6D31919F10350E7E37
SHA1:	19C81E14CD96499CA522E985EF49006061DDE189
SHA-256:	9BCB3D1FF78418525F66B02DAD61C5A09975BF673C27EBD9EAB7AF1B3CACBCBE
SHA-512:	EF44DB604F1990F96A422C4937D87CFA31C0793BC1E5B03EABFD464480633EACBB286A7DD31EE3250DCAC55585DC7E55EB4E504D44973A4E66D7A3AC13E4D0EA
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqdh50wm.iiz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvblbacv.ofr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\msi9DD4.txt

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	3.0073551160284637
Encrypted:	false
SSDEEP:	3:Q0JUINRYplflrOdlVWNlANf5Yplf955:Q0JB0LJOn03ANqLN
MD5:	7A131AC8F407D08D1649D8B66D73C3B0
SHA1:	D93E1B78B1289FB51E791E524162D69D19753F22
SHA-256:	9ACBF0D3EEF230CC2D5A394CA5657AE42F3E369292DA663E2537A278A811FF5B
SHA-512:	47B6FF38B4DF0845A83F17E0FE889747A478746E1E7F17926A5CCAC1DD39C71D93F05A88E0EC176C1E5D752F85D4BDCFFB5C64125D1BA92ACC91D03D6031848D
Malicious:	true
Preview:	..Q.u.i.t.e.S.e.s. .:.<.-.>.:. . .<.<.:.>.>. .E.x.t.e.n.d.E.x.p.i.r.e. .:.<.-.>.:. .0. .<.<.:.>.>. .

C:\Users\user\AppData\Local\Temp\pss9DE7.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6668
Entropy (8bit):	3.5127462716425657
Encrypted:	false
SSDEEP:	96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
MD5:	30C30EF2CB47E35101D13402B5661179
SHA1:	25696B2AAB86A9233F19017539E2DD83B2F75D4E
SHA-256:	53094DF6FA4E57A3265FF04BC1E970C10BCDB3D4094AD6DD610C05B7A8B79E0F
SHA-512:	882BE2768138BB75FF7DDE7D5CA4C2E024699398BAACD0CE1D4619902402E054297E4F464D8CB3C22B2F35D3DABC408122C207FACAD64EC8014F2C54834CF458
Malicious:	true
Preview:	..p.a.r.a.m.(..... . .[.a.l.i.a.s.(.".p.r.o.p.F.i.l.e.".).]. . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.O.u.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".p.r.o.p.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.K.V.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".l.i.n.e.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.L.i.n.e.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.F.i.l.e.".).]. . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.A.r.g.s.F.i.l.e.".).].[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.f.a.l.s.e.).].[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.A.r.g.s.F.i.l.e.P.a.t.h..... .,.[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\scr9DD5.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.5081452196908582
Encrypted:	false
SSDEEP:	6:Q9kVk79idK3fOlFowlzS+KiV6wk4rMTlP1LlG7JidK3falnUOn03AnfYBB:Q9k4KvowBNdk4rMTQNeFUr3hB
MD5:	25A91A8E49BFEDD214CFF0E00B272D8B
SHA1:	54E1BE147BB8B7E4F4FBC0A5FC705F5DC055E18B
SHA-256:	F9FA463780F3A22FE9F1F3AA276457EB855A3214B0F9C67416987BB08456FCE1
SHA-512:	E96FB585D29D4F431E125628D2EE0EAB82B852C9F4C55C4BE0F391EF876FFFF12C59366A8176D7BB7FC115F6FBA89CAD13EE03BFFDB76BCE4ABF414AEC08B429
Malicious:	true
Preview:	..$.s.e.g.o.i.j.e. .=. .A.I._.G.e.t.M.s.i.P.r.o.p.e.r.t.y. .".Q.u.i.t.e.S.e.s.".....$.q.o.p.i.j.i.w. .=. .[.u.i.n.t.3.2.].(.$.s.e.g.o.i.j.e. .-.r.e.p.l.a.c.e. .'.t.'.,. .'.'.).....A.I._.S.e.t.M.s.i.P.r.o.p.e.r.t.y. .".E.x.t.e.n.d.E.x.p.i.r.e.". .$.q.o.p.i.j.i.w.

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\BCUninstaller.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	310928
Entropy (8bit):	6.001677789306043
Encrypted:	false
SSDEEP:	3072:Zczkitvo4BpYN/6mBPry8TXROLdW5m4mURs9OOGC0kvxVCd7wANmSrvlPSIB0P+4:ZA4NCmBPry/N24OOjVxM7RNrrvEc0a
MD5:	147B71C906F421AC77F534821F80A0C6
SHA1:	3381128CA482A62333E20D0293FDA50DC5893323
SHA-256:	7DCD48CEF4CC4C249F39A373A63BBA97C66F4D8AFDBE3BAB196FD452A58290B2
SHA-512:	2FCD2127D9005D66431DD8C9BD5BC60A148D6F3DFE4B80B82672AFD0D148F308377A0C38D55CA58002E5380D412CE18BD0061CB3B12F4DAA90E0174144EA20C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: K064a7Rfk7.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: u1XWB0BIju.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: 6a7e35.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8.}\|...\|...\|....../p....../v....../1...u.a.l....../u...\|........./v....../}...Rich\|...........PE..d...i..d..........".................`<.........@..........................................`.................................................t$...........S...`..@........(..............T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data........@......................@....pdata..@....`.......&..............@..@_RDATA...............<..............@..@.rsrc....S.......T...>..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\UnRar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	506008
Entropy (8bit):	6.4284173495366845
Encrypted:	false
SSDEEP:	6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
MD5:	98CCD44353F7BC5BAD1BC6BA9AE0CD68
SHA1:	76A4E5BF8D298800C886D29F85EE629E7726052D
SHA-256:	E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B
SHA-512:	D6E8146A1055A59CBA5E2AAF47F6CB184ACDBE28E42EC3DAEBF1961A91CEC5904554D9D433EBF943DD3639C239EF11560FA49F00E1CFF02E11CD8D3506C4125F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: K064a7Rfk7.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: u1XWB0BIju.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: setup.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: 6a7e35.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.}............\|.&.....\|.$.J...\|.%.....H}*.....H}./....H}./.....~P.....H}./.....~D.........z...F}./....F}(.....F}./....Rich............PE..d.....@f.........."....!.b.....................@.....................................'....`.................................................\|...........H........4.......(......8...0I..T....................J..(....G..@............................................text....a.......b.................. ..`.rdata...3.......4...f..............@..@.data...............................@....pdata...4.......6..................@..@_RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.596101286914553
Encrypted:	false
SSDEEP:	192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ
MD5:	919E653868A3D9F0C9865941573025DF
SHA1:	EFF2D4FF97E2B8D7ED0E456CB53B74199118A2E2
SHA-256:	2AFBFA1D77969D0F4CEE4547870355498D5C1DA81D241E09556D0BD1D6230F8C
SHA-512:	6AEC9D7767EB82EBC893EBD97D499DEBFF8DA130817B6BB4BCB5EB5DE1B074898F87DB4F6C48B50052D4F8A027B3A707CAD9D7ED5837A6DD9B53642B8A168932
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...Y.=i.........." .........................................................0......a.....`.........................................`...,............ ...................!..............T............................................................................rdata..P...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.640081558424349
Encrypted:	false
SSDEEP:	192:iTWYhWyWWFYg7VWQ4uWq6Cu87ZqnajgnLSyu:sWYhWi1XHllk2yu
MD5:	7676560D0E9BC1EE9502D2F920D2892F
SHA1:	4A7A7A99900E41FF8A359CA85949ACD828DDB068
SHA-256:	00942431C2D3193061C7F4DC340E8446BFDBF792A7489F60349299DFF689C2F9
SHA-512:	F1E8DB9AD44CD1AA991B9ED0E000C58978EB60B3B7D9908B6EB78E8146E9E12590B0014FC4A97BC490FFE378C0BF59A6E02109BFD8A01C3B6D0D653A5B612D15
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....y1..........." .........................................................0...........`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11712
Entropy (8bit):	6.6023398138369505
Encrypted:	false
SSDEEP:	192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH
MD5:	AC51E3459E8FCE2A646A6AD4A2E220B9
SHA1:	60CF810B7AD8F460D0B8783CE5E5BBCD61C82F1A
SHA-256:	77577F35D3A61217EA70F21398E178F8749455689DB52A2B35A85F9B54C79638
SHA-512:	6239240D4F4FA64FC771370FB25A16269F91A59A81A99A6A021B8F57CA93D6BB3B3FCECC8DEDE0EF7914652A2C85D84D774F13A4143536A3F986487A776A2EAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....Ab.........." .........................................................0......d.....`.........................................`................ ...................!..............T............................................................................rdata..4...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.614262942006268
Encrypted:	false
SSDEEP:	192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5
MD5:	B0E0678DDC403EFFC7CDC69AE6D641FB
SHA1:	C1A4CE4DED47740D3518CD1FF9E9CE277D959335
SHA-256:	45E48320ABE6E3C6079F3F6B84636920A367989A88F9BA6847F88C210D972CF1
SHA-512:	2BADF761A0614D09A60D0ABB6289EBCBFA3BF69425640EB8494571AFD569C8695AE20130AAC0E1025E8739D76A9BFF2EFC9B4358B49EFE162B2773BE9C3E2AD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0............`.........................................`................ ...................!..............T............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.654155040985372
Encrypted:	false
SSDEEP:	192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm
MD5:	94788729C9E7B9C888F4E323A27AB548
SHA1:	B0BA0C4CF1D8B2B94532AA1880310F28E87756EC
SHA-256:	ACCDD7455FB6D02FE298B987AD412E00D0B8E6F5FB10B52826367E7358AE1187
SHA-512:	AB65495B1D0DD261F2669E04DC18A8DA8F837B9AC622FC69FDE271FF5E6AA958B1544EDD8988F017D3DD83454756812C927A7702B1ED71247E506530A11F21C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....:.[.........." .........................................................0......~.....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15304
Entropy (8bit):	6.548897063441128
Encrypted:	false
SSDEEP:	192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu
MD5:	580D9EA2308FC2D2D2054A79EA63227C
SHA1:	04B3F21CBBA6D59A61CD839AE3192EA111856F65
SHA-256:	7CB0396229C3DA434482A5EF929D3A2C392791712242C9693F06BAA78948EF66
SHA-512:	97C1D3F4F9ADD03F21C6B3517E1D88D1BF9A8733D7BDCA1AECBA9E238D58FF35780C4D865461CC7CD29E9480B3B3B60864ABB664DCDC6F691383D0B281C33369
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................@............`.........................................`................0...................!..............T............................................................................rdata..(...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11712
Entropy (8bit):	6.622041192039296
Encrypted:	false
SSDEEP:	192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N
MD5:	35BC1F1C6FBCCEC7EB8819178EF67664
SHA1:	BBCAD0148FF008E984A75937AADDF1EF6FDA5E0C
SHA-256:	7A3C5167731238CF262F749AA46AB3BFB2AE1B22191B76E28E1D7499D28C24B7
SHA-512:	9AB9B5B12215E57AF5B3C588ED5003D978071DC591ED18C78C4563381A132EDB7B2C508A8B75B4F1ED8823118D23C88EDA453CD4B42B9020463416F8F6832A3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0......./....`.........................................`...L............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.730719514840594
Encrypted:	false
SSDEEP:	192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq
MD5:	3BF4406DE02AA148F460E5D709F4F67D
SHA1:	89B28107C39BB216DA00507FFD8ADB7838D883F6
SHA-256:	349A79FA1572E3538DFBB942610D8C47D03E8A41B98897BC02EC7E897D05237E
SHA-512:	5FF6E8AD602D9E31AC88E06A6FBB54303C57D011C388F46D957AEE8CD3B7D7CCED8B6BFA821FF347ADE62F7359ACB1FBA9EE181527F349C03D295BDB74EFBACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.626458901834476
Encrypted:	false
SSDEEP:	192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS
MD5:	BBAFA10627AF6DFAE5ED6E4AEAE57B2A
SHA1:	3094832B393416F212DB9107ADD80A6E93A37947
SHA-256:	C78A1217F8DCB157D1A66B80348DA48EBDBBEDCEA1D487FC393191C05AAD476D
SHA-512:	D5FCBA2314FFE7FF6E8B350D65A2CDD99CA95EA36B71B861733BC1ED6B6BB4D85D4B1C4C4DE2769FBF90D4100B343C250347D9ED1425F4A6C3FE6A20AED01F17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...>G.j.........." .........................................................0............`.........................................`...`............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.577869728469469
Encrypted:	false
SSDEEP:	192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA
MD5:	3A4B6B36470BAD66621542F6D0D153AB
SHA1:	5005454BA8E13BAC64189C7A8416ECC1E3834DC6
SHA-256:	2E981EE04F35C0E0B7C58282B70DCC9FC0318F20F900607DAE7A0D40B36E80AF
SHA-512:	84B00167ABE67F6B58341045012723EF4839C1DFC0D8F7242370C4AD9FABBE4FEEFE73F9C6F7953EAE30422E0E743DC62503A0E8F7449E11C5820F2DFCA89294
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......M.....`.........................................`................ ...................!..............T............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11712
Entropy (8bit):	6.6496318655699795
Encrypted:	false
SSDEEP:	192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8
MD5:	A038716D7BBD490378B26642C0C18E94
SHA1:	29CD67219B65339B637A1716A78221915CEB4370
SHA-256:	B02324C49DD039FA889B4647331AA9AC65E5ADC0CC06B26F9F086E2654FF9F08
SHA-512:	43CB12D715DDA4DCDB131D99127417A71A16E4491BC2D5723F63A1C6DFABE578553BC9DC8CF8EFFAE4A6BE3E65422EC82079396E9A4D766BF91681BDBD7837B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...*............." .........................................................0......-.....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	6.587452239016064
Encrypted:	false
SSDEEP:	192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl
MD5:	D75144FCB3897425A855A270331E38C9
SHA1:	132C9ADE61D574AA318E835EB78C4CCCDDEFDEA2
SHA-256:	08484ED55E43584068C337281E2C577CF984BB504871B3156DE11C7CC1EEC38F
SHA-512:	295A6699529D6B173F686C9BBB412F38D646C66AAB329EAC4C36713FDD32A3728B9C929F9DCADDE562F625FB80BC79026A52772141AD2080A0C9797305ADFF2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0......V`....`.........................................`................ ...................!..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14280
Entropy (8bit):	6.658205945107734
Encrypted:	false
SSDEEP:	384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D
MD5:	8ACB83D102DABD9A5017A94239A2B0C6
SHA1:	9B43A40A7B498E02F96107E1524FE2F4112D36AE
SHA-256:	059CB23FDCF4D80B92E3DA29E9EF4C322EDF6FBA9A1837978FD983E9BDFC7413
SHA-512:	B7ECF60E20098EA509B76B1CC308A954A6EDE8D836BF709790CE7D4BD1B85B84CF5F3AEDF55AF225D2D21FBD3065D01AA201DAE6C131B8E1E3AA80ED6FC910A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......._....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.621310788423453
Encrypted:	false
SSDEEP:	96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7
MD5:	808F1CB8F155E871A33D85510A360E9E
SHA1:	C6251ABFF887789F1F4FC6B9D85705788379D149
SHA-256:	DADBD2204B015E81F94C537AC7A36CD39F82D7C366C193062210C7288BAA19E3
SHA-512:	441F36CA196E1C773FADF17A0F64C2BBDC6AF22B8756A4A576E6B8469B4267E942571A0AE81F4B2230B8DE55702F2E1260E8D0AFD5447F2EA52F467F4CAA9BC6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...f092.........." .........................................................0............`.........................................`...l............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.7263193693903345
Encrypted:	false
SSDEEP:	192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p
MD5:	CFF476BB11CC50C41D8D3BF5183D07EC
SHA1:	71E0036364FD49E3E535093E665F15E05A3BDE8F
SHA-256:	B57E70798AF248F91C8C46A3F3B2952EFFAE92CA8EF9640C952467BC6726F363
SHA-512:	7A87E4EE08169E9390D0DFE607E9A220DC7963F9B4C2CDC2F8C33D706E90DC405FBEE00DDC4943794FB502D9882B21FAAE3486BC66B97348121AE665AE58B01C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....%..........." .........................................................0......[.....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.601327134572443
Encrypted:	false
SSDEEP:	192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe
MD5:	F43286B695326FC0C20704F0EEBFDEA6
SHA1:	3E0189D2A1968D7F54E721B1C8949487EF11B871
SHA-256:	AA415DB99828F30A396CBD4E53C94096DB89756C88A19D8564F0EED0674ADD43
SHA-512:	6EAD35348477A08F48A9DEB94D26DA5F4E4683E36F0A46117B078311235C8B9B40C17259C2671A90D1A210F73BF94C9C063404280AC5DD5C7F9971470BEAF8B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......Z....`.........................................`...H............ ...................!..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14272
Entropy (8bit):	6.519411559704781
Encrypted:	false
SSDEEP:	192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
MD5:	E173F3AB46096482C4361378F6DCB261
SHA1:	7922932D87D3E32CE708F071C02FB86D33562530
SHA-256:	C9A686030E073975009F993485D362CC31C7F79B683DEF713E667D13E9605A14
SHA-512:	3AAFEFD8A9D7B0C869D0C49E0C23086115FD550B7DC5C75A5B8A8620AD37F36A4C24D2BF269043D81A7448C351FF56CB518EC4E151960D4F6BD655C38AFF547F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...j............." .........................................................0......%C....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.659079053710614
Encrypted:	false
SSDEEP:	192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
MD5:	9C9B50B204FCB84265810EF1F3C5D70A
SHA1:	0913AB720BD692ABCDB18A2609DF6A7F85D96DB3
SHA-256:	25A99BDF8BF4D16077DC30DD9FFEF7BB5A2CEAF9AFCEE7CF52AD408355239D40
SHA-512:	EA2D22234E587AD9FA255D9F57907CC14327EAD917FDEDE8B0A38516E7C7A08C4172349C8A7479EC55D1976A37E520628006F5C362F6A3EC76EC87978C4469CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......6y....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11200
Entropy (8bit):	6.7627840671368835
Encrypted:	false
SSDEEP:	192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
MD5:	0233F97324AAAA048F705D999244BC71
SHA1:	5427D57D0354A103D4BB8B655C31E3189192FC6A
SHA-256:	42F4E84073CF876BBAB9DD42FD87124A4BA10BB0B59D2C3031CB2B2DA7140594
SHA-512:	8339F3C0D824204B541AECBD5AD0D72B35EAF6717C3F547E0FD945656BCB2D52E9BD645E14893B3F599ED8F2DE6D3BCBEBF3B23ED43203599AF7AFA5A4000311
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....f............" .........................................................0.......>....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.590253878523919
Encrypted:	false
SSDEEP:	192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
MD5:	E1BA66696901CF9B456559861F92786E
SHA1:	D28266C7EDE971DC875360EB1F5EA8571693603E
SHA-256:	02D987EBA4A65509A2DF8ED5DD0B1A0578966E624FCF5806614ECE88A817499F
SHA-512:	08638A0DD0FB6125F4AB56E35D707655F48AE1AA609004329A0E25C13D2E71CB3EDB319726F10B8F6D70A99F1E0848B229A37A9AB5427BFEE69CD890EDFB89D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...._............" .........................................................0.......S....`.........................................`................ ...................!..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.672720452347989
Encrypted:	false
SSDEEP:	192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
MD5:	7A15B909B6B11A3BE6458604B2FF6F5E
SHA1:	0FEB824D22B6BEEB97BCE58225688CB84AC809C7
SHA-256:	9447218CC4AB1A2C012629AAAE8D1C8A428A99184B011BCC766792AF5891E234
SHA-512:	D01DD566FF906AAD2379A46516E6D060855558C3027CE3B991056244A8EDD09CE29EACEC5EE70CEEA326DED7FC2683AE04C87F0E189EBA0E1D38C06685B743C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....<.........." .........................................................0.......g....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13760
Entropy (8bit):	6.575688560984027
Encrypted:	false
SSDEEP:	192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
MD5:	6C3FCD71A6A1A39EAB3E5C2FD72172CD
SHA1:	15B55097E54028D1466E46FEBCA1DBB8DBEFEA4F
SHA-256:	A31A15BED26232A178BA7ECB8C8AA9487C3287BB7909952FC06ED0D2C795DB26
SHA-512:	EF1C14965E5974754CC6A9B94A4FA5107E89966CB2E584CE71BBBDD2D9DC0C0536CCC9D488C06FA828D3627206E7D9CC8065C45C6FB0C9121962CCBECB063D4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0............`.........................................`...X............ ...................!..............T............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.70261983917014
Encrypted:	false
SSDEEP:	192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
MD5:	D175430EFF058838CEE2E334951F6C9C
SHA1:	7F17FBDCEF12042D215828C1D6675E483A4C62B1
SHA-256:	1C72AC404781A9986D8EDEB0EE5DD39D2C27CE505683CA3324C0ECCD6193610A
SHA-512:	6076086082E3E824309BA2C178E95570A34ECE6F2339BE500B8B0A51F0F316B39A4C8D70898C4D50F89F3F43D65C5EBBEC3094A47D91677399802F327287D43B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0......G.....`.........................................`...x............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.599515320379107
Encrypted:	false
SSDEEP:	192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
MD5:	9D43B5E3C7C529425EDF1183511C29E4
SHA1:	07CE4B878C25B2D9D1C48C462F1623AE3821FCEF
SHA-256:	19C78EF5BA470C5B295DDDEE9244CBD07D0368C5743B02A16D375BFB494D3328
SHA-512:	C8A1C581C3E465EFBC3FF06F4636A749B99358CA899E362EA04B3706EAD021C69AE9EA0EFC1115EAE6BBD9CF6723E22518E9BEC21F27DDAAFA3CF18B3A0034A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r............" .........................................................0............`.........................................`...H............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.690164913578267
Encrypted:	false
SSDEEP:	192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
MD5:	43E1AE2E432EB99AA4427BB68F8826BB
SHA1:	EEE1747B3ADE5A9B985467512215CAF7E0D4CB9B
SHA-256:	3D798B9C345A507E142E8DACD7FB6C17528CC1453ABFEF2FFA9710D2FA9E032C
SHA-512:	40EC0482F668BDE71AEB4520A0709D3E84F093062BFBD05285E2CC09B19B7492CB96CDD6056281C213AB0560F87BD485EE4D2AEEFA0B285D2D005634C1F3AF0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....Y$..........." .........................................................0.......d....`.........................................`...H............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.615761482304143
Encrypted:	false
SSDEEP:	192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
MD5:	735636096B86B761DA49EF26A1C7F779
SHA1:	E51FFBDDBF63DDE1B216DCCC753AD810E91ABC58
SHA-256:	5EB724C51EECBA9AC7B8A53861A1D029BF2E6C62251D00F61AC7E2A5F813AAA3
SHA-512:	3D5110F0E5244A58F426FBB72E17444D571141515611E65330ECFEABDCC57AD3A89A1A8B2DC573DA6192212FB65C478D335A86678A883A1A1B68FF88ED624659
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......Xc....`.........................................`...<............ ...................!..............T............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.627282858694643
Encrypted:	false
SSDEEP:	192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
MD5:	031DC390780AC08F498E82A5604EF1EB
SHA1:	CF23D59674286D3DC7A3B10CD8689490F583F15F
SHA-256:	B119ADAD588EBCA7F9C88628010D47D68BF6E7DC6050B7E4B787559F131F5EDE
SHA-512:	1468AD9E313E184B5C88FFD79A17C7D458D5603722620B500DBA06E5B831037CD1DD198C8CE2721C3260AB376582F5791958763910E77AA718449B6622D023C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d..../}..........." .........................................................0......a.....`.........................................0................ ...................!..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15816
Entropy (8bit):	6.435326465651674
Encrypted:	false
SSDEEP:	192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
MD5:	285DCD72D73559678CFD3ED39F81DDAD
SHA1:	DF22928E43EA6A9A41C1B2B5BFCAB5BA58D2A83A
SHA-256:	6C008BE766C44BF968C9E91CDDC5B472110BEFFEE3106A99532E68C605C78D44
SHA-512:	84EF0A843798FD6BD6246E1D40924BE42550D3EF239DAB6DB4D423B142FA8F691C6F0603687901F1C52898554BF4F48D18D3AEBD47DE935560CDE4906798C39A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...x............." .........................................................@.......5....`.........................................0................0...................!..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.5874576656353145
Encrypted:	false
SSDEEP:	192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
MD5:	5CCE7A5ED4C2EBAF9243B324F6618C0E
SHA1:	FDB5954EE91583A5A4CBB0054FB8B3BF6235EED3
SHA-256:	AA3E3E99964D7F9B89F288DBE30FF18CBC960EE5ADD533EC1B8326FE63787AA3
SHA-512:	FC85A3BE23621145B8DC067290BD66416B6B1566001A799975BF99F0F526935E41A2C8861625E7CFB8539CA0621ED9F46343C04B6C41DB812F58412BE9C8A0DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...g P..........." .........................................................0............`.........................................0..."............ ...................!..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13768
Entropy (8bit):	6.645869978118917
Encrypted:	false
SSDEEP:	192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
MD5:	41FBBB054AF69F0141E8FC7480D7F122
SHA1:	3613A572B462845D6478A92A94769885DA0843AF
SHA-256:	974AF1F1A38C02869073B4E7EC4B2A47A6CE8339FA62C549DA6B20668DE6798C
SHA-512:	97FB0A19227887D55905C2D622FBF5451921567F145BE7855F72909EB3027F48A57D8C4D76E98305121B1B0CC1F5F2667EF6109C59A83EA1B3E266934B2EB33C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r..x.........." .........................................................0.......(....`.........................................0................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avcodec-60.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	37333152
Entropy (8bit):	6.632921864082428
Encrypted:	false
SSDEEP:	393216:LzyCmQCOCLheXbl4MEf+Eidgrpj3xO6FLzq2KHplhrX5:L5WLheXbl4MEf+HgrpjVF6PD5
MD5:	32F56F3E644C4AC8C258022C93E62765
SHA1:	06DFF5904EBBF69551DFA9F92E6CC2FFA9679BA1
SHA-256:	85AF2FB4836145098423E08218AC381110A6519CB559FF6FC7648BA310704315
SHA-512:	CAE2B9E40FF71DDAF76A346C20028867439B5726A16AE1AD5E38E804253DFCF6ED0741095A619D0999728D953F2C375329E86B8DE4A0FCE55A8CDC13946D5AD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........(........&"...&............P........................................P.......3:...`... ......................................`...........A.....p.......t...X.9.H'.......M..............................(......................P............................text...............................`..`.rodata.0........................... ..`.data...............................@....rdata....X......X.................@..@.pdata..t...........................@..@.xdata..`...........................@..@.bss...................................edata.......`.......\|..............@..@.idata...A.......B..................@....CRT....`..........................@....tls...............................@....rsrc...p..........................@....reloc...M.......N..................@..B........................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avformat-60.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5100112
Entropy (8bit):	6.374242928276845
Encrypted:	false
SSDEEP:	49152:WBUp8DPNkkup6GAx9HEekwEfG/66xcPiw+UgAnBM+sVf9d3PWKOyz/Omlc69kXOV:WB/Z16w8idUgfT0b6LnBSpytGyodUl
MD5:	01589E66D46ABCD9ACB739DA4B542CE4
SHA1:	6BF1BD142DF68FA39EF26E2CAE82450FED03ECB6
SHA-256:	9BB4A5F453DA85ACD26C35969C049592A71A7EF3060BFA4EB698361F2EDB37A3
SHA-512:	0527AF5C1E7A5017E223B3CC0343ED5D42EC236D53ECA30D6DECCEB2945AF0C1FBF8C7CE367E87BC10FCD54A77F5801A0D4112F783C3B7E829B2F40897AF8379
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........D..,....&"...&.R4...D.....P.........................................E.....r}N...`... .......................................D.0-....D.hX...PE.......?.......M.H'...`E..e............................>.(.....................D.`............................text....P4......R4.................`..`.data....3...p4..4...V4.............@....rdata...&....4..(....4.............@..@.pdata........?.......?.............@..@.xdata..8{....A..\|...TA.............@..@.bss..........D..........................edata..0-....D.......C.............@..@.idata..hX....D..Z....C.............@....CRT....`....0E......XD.............@....tls.........@E......ZD.............@....rsrc........PE......\D.............@....reloc...e...`E..f...`D.............@..B................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\avutil-58.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1089600
Entropy (8bit):	6.535744457220272
Encrypted:	false
SSDEEP:	24576:NFUq9wHzADwiB0Bm3k6gz0sA+wLDZyoFNRsKYw:TUdMDwIgm3kpzsNpyoFDsKYw
MD5:	3AAF57892F2D66F4A4F0575C6194F0F8
SHA1:	D65C9143603940EDE756D7363AB6750F6B45AB4E
SHA-256:	9E0D0A05B798DA5D6C38D858CE1AD855C6D68BA2F9822FA3DA16E148E97F9926
SHA-512:	A5F595D9C48B8D5191149D59896694C6DD0E9E1AF782366162D7E3C90C75B2914F6E7AFF384F4B59CA7C5A1ECCCDBF5758E90A6A2B14A8625858A599DCCA429B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........f..X.....&"...&.2...b......P......................................... ......?....`... ......................................0 .xC.... ....... .h.......@>...x..H'.... ............................. Z..(..................... .P............................text....1.......2..................`..`.data........P.......6..............@....rdata...,...`.......8..............@..@.pdata..@>.......@...f..............@..@.xdata...K.......L..................@..@.bss......... ...........................edata..xC...0 ..D..................@..@.idata........ ......6..............@....CRT....`..... ......N..............@....tls.......... ......P..............@....rsrc...h..... ......R..............@....reloc........ ......V..............@..B................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57488
Entropy (8bit):	6.382541157520703
Encrypted:	false
SSDEEP:	768:eQ6XULhGj8TzwsoeZwVAsuEIBh8v6H3eQdFyN+yghK3m5rR8vSoQuSd:ECVbTGkiE/c+XA3g2L7S
MD5:	71F796B486C7FAF25B9B16233A7CE0CD
SHA1:	21FFC41E62CD5F2EFCC94BAF71BD2659B76D28D3
SHA-256:	B2ACB555E6D5C6933A53E74581FD68D523A60BCD6BD53E4A12D9401579284FFD
SHA-512:	A82EA6FC7E7096C10763F2D821081F1B1AFFA391684B8B47B5071640C8A4772F555B953445664C89A7DFDB528C5D91A9ADDB5D73F4F5E7509C6D58697ED68432
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l............uU.....x.....x.....x....{...........ox....ox9....ox....Rich...........................PE..d......d.........."......f...N......p).........@....................................2.....`.....................................................................P........(......d.......T...............................8............................................text....e.......f.................. ..`.rdata...6.......8...j..............@..@.data...............................@....pdata..P...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\iwhgjds.rar

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	435406
Entropy (8bit):	7.999546729128828
Encrypted:	true
SSDEEP:	12288:nQmsP8s0SJf70d8P60PVjZmzhs//6yZqcB3PkGGaB:tsPNzz0mP6kBR8FaB
MD5:	85AE2F49E50D3860B37A5E8148AE16C9
SHA1:	49A99D1F2D58E0F60DDF30DBC2CC66ADCA083983
SHA-256:	7B3C3AA6007296BA00C55F9242F0F79D3F20B087766A3BB0FD66DD2D629FA73D
SHA-512:	D124BDEDE1B4FE7347B6B5CD6145308F2A4905ECF4BF2288A5057DDA0666F96DE16AFFC8DDDE2C8B914273E8D6D44B9602B992682CB53BEB6A08B7AD2BF666EB
Malicious:	false
Preview:	Rar!....lx.\!........b^v..z.Q..Y..Q.....J!...R.'..uR...x#.......t@..:...(..x..L.....k...K....ztykV.N..l...8....^.g.......+...MX:...7..f.b#._<J;.hu..V/..&.z..414d3G..R..qB.......g#.b?.....QN.._x.l....Z...%pZb_g.-}.MTL.LS5.......(.8.+.-...z,.....}g8..#.;...e........\..).....o8KN.Q.a].........7..,)D.Rl..Db......RW'=.t.....YD....J.^qP....5;..6....e.x...+..P..Q..".M..B....#...gm!j..}.C..C......\.p.s\|r.-...RH.%.&..1s.S...w<...a..ED..=...4{;.9.7.q..@..+....$.P....7J..&......D..K...........`..x]\.....h..&.v....E..Xq'?.`..\|.u......2.=..Z.Q...7n...:..._.. a2..?V...4.].c./&.L..d...!...i%&......[..oJ.t..r..F.1.:.i.(TZ......@....,J....3...Y..b.Kz_.H........ ....N../.(.....2& ;.4.@/..9.k.x....&......=+6...a.......S.....GG.....MP.{..x}Tc..\?QA.r\..>...W-.T.*..3..?U .^.X...1h..9.I.....n..tS....N.....8t5x....... h$.iu..H.2...\P-X..5....9..v.....o.......F_2D..M`..s....e...JIe[..%.o.\...J.&#}..f...-.U..>......M.".......^..Z.....;.5k..:H

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\msvcp140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	566704
Entropy (8bit):	6.494428734965787
Encrypted:	false
SSDEEP:	12288:M/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zuyLQEKZm+jWodj:yN59IW6zuAQEKZm+jWodEEY1u
MD5:	6DA7F4530EDB350CF9D967D969CCECF8
SHA1:	3E2681EA91F60A7A9EF2407399D13C1CA6AA71E9
SHA-256:	9FEE6F36547D6F6EA7CA0338655555DBA6BB0F798BC60334D29B94D1547DA4DA
SHA-512:	1F77F900215A4966F7F4E5D23B4AAAD203136CB8561F4E36F03F13659FE1FF4B81CAA75FEF557C890E108F28F0484AD2BAA825559114C0DAA588CF1DE6C1AFAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y...................Z.........O.....O.....O.....O.....O.....O.6....O.....Rich...........................PE..d...%\|.a.........." .....<...\.......)...................................................`A.........................................5..h...(...,............p...9...~...'......0.......T...............................8............P...............................text....;.......<.................. ..`.rdata..j....P.......@..............@..@.data...`:...0......................@....pdata...9...p...:...6..............@..@.rsrc................p..............@..@.reloc..0............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35656
Entropy (8bit):	6.370522595411868
Encrypted:	false
SSDEEP:	768:ixmeWkfdHAWcgj7Y7rEabyLcRwEpYinAMx1nyqaJ:pXUdg8jU7r4LcRZ7Hx1nyqa
MD5:	D3CAC4D7B35BACAE314F48C374452D71
SHA1:	95D2980786BC36FEC50733B9843FDE9EAB081918
SHA-256:	4233600651FB45B9E50D2EC8B98B9A76F268893B789A425B4159675B74F802AA
SHA-512:	21C8D73CC001EF566C1F3C7924324E553A6DCA68764ECB11C115846CA54E74BD1DFED12A65AF28D9B00DDABA04F987088AA30E91B96E050E4FC1A256FFF20880
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D..D..D..M.3.J......F......W......N......G......F..D..l......A..D.........E...._.E......E..RichD..................PE..d................"....#.2...4......`7.........@..........................................`..................................................b..,....................d..H'......<....Z..p...........................`Y..@............P...............................text....1.......2.................. ..`.rdata..H"...P...$...6..............@..@.data...H............Z..............@....pdata...............\..............@..@.rsrc................`..............@..@.reloc..<............b..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\suriqk.bat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.879664004902594
Encrypted:	false
SSDEEP:	3:mKDDlR+7H6U:hOD6U
MD5:	D9324699E54DC12B3B207C7433E1711C
SHA1:	864EB0A68C2979DCFF624118C9C0618FF76FA76C
SHA-256:	EDFACD2D5328E4FFF172E0C21A54CC90BAF97477931B47B0A528BFE363EF7C7E
SHA-512:	E8CC55B04A744A71157FCCA040B8365473C1165B3446E00C61AD697427221BE11271144F93F853F22906D0FEB61BC49ADFE9CBA0A1F3B3905E7AD6BD57655EB8
Malicious:	false
Preview:	@echo off..Start "" %1

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swresample-4.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	158968
Entropy (8bit):	6.4238235663554955
Encrypted:	false
SSDEEP:	1536:izN/1rbQ+rTccg/Lla75jjVBzYCDNzuDQr5whduOd7EKPuh9Aco6uAGUtQFUzcnX:8N/FQ+rejlaFhdrXORhjD6VGUtQWk
MD5:	7FB892E2AC9FF6981B6411FF1F932556
SHA1:	861B6A1E59D4CD0816F4FEC6FD4E31FDE8536C81
SHA-256:	A45A29AECB118FC1A27ECA103EAD50EDD5343F85365D1E27211FE3903643C623
SHA-512:	986672FBB14F3D61FFF0924801AAB3E9D6854BB3141B95EE708BF5B80F8552D5E0D57182226BABA0AE8995A6A6F613864AB0E5F26C4DCE4EB88AB82B060BDAC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........O.....&"...&.h..........P.....................................................`... ...................................... .......0..T....`..........X....E..H'...p..................................(...................02...............................text....f.......h..................`..`.data................l..............@....rdata...Q.......R...n..............@..@.pdata..X...........................@..@.xdata..............................@..@.bss.....................................edata....... ......................@..@.idata..T....0......................@....CRT....X....@......................@....tls.........P......................@....rsrc........`......................@....reloc.......p......................@..B................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\swscale-7.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	707200
Entropy (8bit):	6.610520126248797
Encrypted:	false
SSDEEP:	12288:hTl8xt5jEuhuoWZz8Rt5brZcXVEZMbYwepVQ0G6ddTD8qevJMLf50555555555mj:hZ8xt5jEuhuoWZz8Rt5brZcXVEZMbYJz
MD5:	1144E36E0F8F739DB55A7CF9D4E21E1B
SHA1:	9FA49645C0E3BAE0EDD44726138D7C72EECE06DD
SHA-256:	65F8E4D76067C11F183C0E1670972D81E878E6208E501475DE514BC4ED8638FD
SHA-512:	A82290D95247A67C4D06E5B120415318A0524D00B9149DDDD8B32E21BBD0EE4D86BB397778C4F137BF60DDD4167EE2E9C6490B3018031053E9FE3C0D0B3250E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........-.....&"...&............P.....................................................`... ......................................P.......`..........x....P......8...H'......................................(....................c..`............................text...(...........................`..`.data...............................@....rdata...s.......t..................@..@.pdata.......P...0...&..............@..@.xdata...9.......:...V..............@..@.bss.....................................edata.......P......................@..@.idata.......`......................@....CRT....`....p......................@....tls................................@....rsrc...x...........................@....reloc..............................@..B................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\una_front\classes.jsa

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12124160
Entropy (8bit):	4.1175508751036585
Encrypted:	false
SSDEEP:	49152:opbNLHjtBKapOZoWPQ8MQvfyf3t+WpskQS+ZSZmpPwoe5GOSwleJiXACPQDk8p8j:o9NDU1eB1
MD5:	8A13CBE402E0BBF3DA56315F0EBA7F8E
SHA1:	EE8B33FA87D7FA04B9B7766BCF2E2C39C4F641EA
SHA-256:	7B5E6A18A805D030779757B5B9C62721200AD899710FF930FC1C72259383278C
SHA-512:	46B804321AB1642427572DD141761E559924AF5D015F3F1DD97795FB74B6795408DEAD5EA822D2EB8FBD88E747ECCAD9C3EE8F9884DFDB73E87FAD7B541391DA
Malicious:	false
Preview:	.................*.\.....................................+................................Ol.....................................">.............................d..3......................A.......@...... t.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................(#......(............... ................Java HotSpot(TM) 64-Bit Server VM (15.0.1+9-18) for windows-amd64 JRE (15.0.1+9-18), built on Sep 15 2020 14:43:54 by "mach5one" with unknown MS VC++:1925....................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\una_front\java.datatransfer.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	51389
Entropy (8bit):	7.916683616123071
Encrypted:	false
SSDEEP:	768:GO5DN7hkJDEnwQm0aCDOdC4Lk1eo8eNEyu/73vVjPx5S+3TYWFwSvZt6xdWDvw:GO5h7hkREnyvo8QBuDNjfvD1/3vw
MD5:	8F4C0388762CD566EAE3261FF8E55D14
SHA1:	B6C5AA0BBFDDE8058ABFD06637F7BEE055C79F4C
SHA-256:	AAEFACDD81ADEEC7DBF9C627663306EF6B8CDCDF8B66E0F46590CAA95CE09650
SHA-512:	1EF4D8A9D5457AF99171B0D70A330B702E275DCC842504579E24FC98CC0B276F8F3432782E212589FC52AA93BBBC00A236FE927BE0D832DD083E8F5EBDEB67C2
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classeP.N.0..../.$...pAM.D.p..!!..X...m.d'.....P7...biw..Y.?._...pM.m..X.q..2.D8o...o.0.J.s...,...".'..>..F..r..M..G.L......!.je.BG....:v.;..a@...Y...3..?.Y....\.m.).CBwn......'.N..+G+^#.j...R.A..qV.1o...p.....\|._.-N$.!.;X....\|....G......qi.W{PK...^0.........PK.........n/Q............-...classes/java/awt/datatransfer/Clipboard.class.X.w.W....c...-.Ii...#.P..........@(`.......3.....R...........<....h..W.z......=.=~....l..DN..............;y.@7..#....2.P.._.WR.b.Km..f......9w1T...A.....d..b.r.Ie.Gq,..U+.kcC.be..eTe......K3.usU.2...Pe.4T.aYz....>!..q..3.dL.Q..fh/#..P.t.;.f,.."..7..v.(..K7}.2nZ;.Mg..OuzU..c.....!wR.xz....7...tG..d.ED..3...fs.{n\...x...r.!.#X.6.Ke.v........1n.P......#..P...J....)^.dt....k...k...F5...e$.d...=~Do.t.2....KX....B.#Ha..U2n.j...+fh&....&.zk,.....>...aQ......kj...:.h.Q.uTv.B ......N......r'..x..D.4.`k 76fZ....fG..#.....7.4.:w..6....#...x..>lfh.B'.....'l..V.....5..H..

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\una_front\java.instrument.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	41127
Entropy (8bit):	7.961466748192397
Encrypted:	false
SSDEEP:	768:L0xH2Z5C7/c8GqFsHWShYYptTpmPSB4gTQSq4Yz1jHoAsbjX:wxH66/crqiH3tTVTsSVYz1jIAsfX
MD5:	D039093C051B1D555C8F9B245B3D7FA0
SHA1:	C81B0DAEDAB28354DEA0634B9AE9E10EE72C4313
SHA-256:	4A495FC5D119724F7D40699BB5D2B298B0B87199D09129AEC88BBBDBC279A68D
SHA-512:	334FD85ACE22C90F8D4F82886EEF1E6583184369A031DCEE6E0B6624291F231D406A2CEC86397C1B94D535B36A5CF7CB632BB9149B8518B794CBFA1D18A2478F
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classU.M..0..../..........LL...A.$.t.\x..e,U.N.N..7o.....=B+..,.@..:.`.....`....L.,.".B.M......:...._..uBGf.5.M..g..."..8K\..B.".z..\|=6.=1.KB..v,.yJ0/......[.r..OU`....Q}...kP.94oh...b..K{...].'PK........#...PK.........n/Q............2...classes/java/lang/instrument/ClassDefinition.class.SMo.@.}.8q.4M.@.h..b;... ..d.RP$.c...#g...#@.....@.G..........7o.......@.-..J.T.eT..'.......tt.=.P9.C_t.J.5... ...Y...z\|.(..TE...e.....(.......v?pg....<...I.1.:....H.U...1.)..p...P.......\|...04..Q..2...%..8~.......#..p"...n..<.Uq..=..:.c..1.2...x.o.w..#....^?q.I..:..Y...6...N..c..>2.k.U...L..&V.H...%....y...[.~GJ...B/M......%...t....+.I.E....H..}....m..j_..8C...:.n...(*..z..Z.Q...$....a.}..T.xW.$....52...T.o..mSL_~.L.FM....W.z.I.]....)..e.....A..$..xH...Td...0i..."...0X....PK..X..~........PK.........n/Q............7...classes/java/lang/instrument/ClassFileTransformer.class.S.n.@.=.8.M.n..b^-/..G..

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\una_front\java.logging.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	113725
Entropy (8bit):	7.928841651831531
Encrypted:	false
SSDEEP:	3072:6jB5A+VPT8IdtpHAUfEzhLpIrxbt2rlnH6:6ZRTPHgU2pItshH6
MD5:	3A03EF8F05A2D0472AE865D9457DAB32
SHA1:	7204170A08115A16A50D5A06C3DE7B0ADB6113B1
SHA-256:	584D15427F5B0AC0CE4BE4CAA2B3FC25030A0CF292F890C6D3F35836BC97FA6D
SHA-512:	1702C6231DAAB27700160B271C3D6171387F89DA0A97A3725B4B9D404C94713CB09BA175DE8E78A8F0CBD8DD0DD73836A38C59CE8D1BD38B4F57771CF9536E77
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuQ.N.1.=W......n\1.D.5$&....T...2%....\..~..3(......9.6...o....%..:L...x.=..p..L.......".Gm........Z9.R+...}x..$.Y,,..-..z..{.v.K..:9m[.dl....Q#t..F$:5c..h..^x".8 \N..A!....O....@.0.Z....p]......0_(.mB...=.J..<.k"4....g<......M$,....:Kz\|..^.........8q..{...}.G....p.S.W...l.M.....PK..R...).......PK.........n/Q................classes/java/util/logging/ConsoleHandler.class}S[o.A...KW..jk.....jy...K.b.R.mH\|.......2.K....h...G..,..K...s..r......7....d.u....C...y3..j..2...1..!wx..2T:.T...b.^..`.D[...0....n.cXy#C..e...=.E.....]..%L..<x.....W........z..u.s..a.e..Zq..-.E@n.!..)....F...\.E...<...[.;W..t.i%.mT".w.x..(.m,...r.....tZ..vPepFI_...D..b..0.U...S;....XP.@..C.#Cq..}aNy_..ZG...q#m<;..g2b.]"..Y.....[7."+..#"wOtb..-..."..@..(.>Y0......C.h...?.~..8A.Mp.....N....Z$ .E...."o.E.uz3;..m.P.z.....7...?.'.q>...2mN.gLv...q1..[}..@~..M.....K..sS.....PK....0w........PK.........n/Q............,...classes/ja

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\una_front\java.management.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	896846
Entropy (8bit):	7.923431656723031
Encrypted:	false
SSDEEP:	12288:3xz+ej0yUGnip25kAyyrAm0G4hcpbLIWFWb4YNlgWUz4u5cnLXlAVz/Q+9Ec8zCU:3cZpcryy8mp4hpSxWUQuV//yDXX
MD5:	C6FBB7D49CAA027010C2A817D80CA77C
SHA1:	4191E275E1154271ABF1E54E85A4FF94F59E7223
SHA-256:	1C8D9EFAEB087AA474AD8416C3C2E0E415B311D43BCCA3B67CBF729065065F09
SHA-512:	FDDC31FA97AF16470EA2F93E3EF206FFB217E4ED8A5C379D69C512652987E345CB977DB84EDA233B190181C6E6E65C173062A93DB3E6BB9EE7E71472C9BBFE34
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.S.N.A.=-.............^PQP4F..\|..]{.........S\|...(cu/..i.d.z...[....'.M\|`.M.GrI.).1.4...8...V.b.EE.Rg...zV.K......Os.W.S?.e.GY.Q`.od..d..Zf....2>.B.29.D.3L7...M&....8.;..2...}..n..n.g...S. ?..._V..Q..9mBo0L..~dD.t.c.ric..2r5qLvr..V....Sm..I}.}.a..Od$2e..M.v.m..w....L..s.C.;...#.f..Ln.......5..9.2....5......P......M.$V.\|;...'mw.Vl.2....D..1%.l.a..o...O....!.......h...9V.L.x..?..n]/.6......iVe..{.4.K..s.[....y..\|2....3,`.a.....H69.a.;09.5K.C....a_.G.`Jm...ER......9I.D.n...Wp........%..WI...tf..pg5..SN.8y..Y'.:9....U.pq.....}.]X..aE....^t..x.l...^....m.#.......a."r.l.2..Lf).y.^.h..u....PK....N.i.......PK.........n/Q............0...classes/com/sun/jmx/defaults/JmxProperties.class.UMS#U.=.aH.4.4.....J2...h..6v.L2q.......tS.)F........\.....Y..h2...*...{.......w..8Ha.....p.C.c..C;..^+S...F.0..xNt....J5.$.b.og..9l.g....Q..k......"..I....b....-..^.n..<x..4.$pY.(..,\~.F..0...Z<`X[...(p...u^.

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	639224
Entropy (8bit):	6.219852228773659
Encrypted:	false
SSDEEP:	12288:FgLcjQQPKZZK8aF4yBj3Fnx4DMDO8jalo:FggjQKuyDnxvOYaC
MD5:	01DACEA3CBE5F2557D0816FC64FAE363
SHA1:	566064A9CB1E33DB10681189A45B105CDD504FD4
SHA-256:	B4C96B1E5EEE34871D9AB43BCEE8096089742032C0669DF3C9234941AAC3D502
SHA-512:	C22BFE54894C26C0BD8A99848B33E1B9A9859B3C0C893CB6039F9486562C98AA4CEAB0D28C98C1038BD62160E03961A255B6F8627A7B2BB51B86CC7D6CBA9151
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*...D..D..D.....D.1J...D...@..D...G..D...A..D...E..D..E..D...E..D..E.O.D...A..D...D..D......D.....D...F..D.Rich..D.........PE..d.....-a.........." ...............................................................E..... .....................................................,.......@....p..xK..................`...T.......................(.......................(............................text............................... ..`.rdata..H=.......>..................@..@.data....H... ...@..................@....pdata..xK...p...L...J..............@..@.rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98224
Entropy (8bit):	6.452201564717313
Encrypted:	false
SSDEEP:	1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
MD5:	F34EB034AA4A9735218686590CBA2E8B
SHA1:	2BC20ACDCB201676B77A66FA7EC6B53FA2644713
SHA-256:	9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
SHA-512:	D27D5E65E8206BD7923CF2A3C4384FEC0FC59E8BC29E25F8C03D039F3741C01D1A8C82979D7B88C10B209DB31FBBEC23909E976B3EE593DC33481F0050A445AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...%\|.a.........." .........`......p................................................{....`A.........................................B..4....J...............p..X....X...'..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140_1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37256
Entropy (8bit):	6.297533243519742
Encrypted:	false
SSDEEP:	384:5hnvMCmWEKhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+Xf0+uncS7IO5WrCKWU/tQ0g:YCm5KhUcwrHY/ntTxT6ov07b4SwY1zl
MD5:	135359D350F72AD4BF716B764D39E749
SHA1:	2E59D9BBCCE356F0FECE56C9C4917A5CACEC63D7
SHA-256:	34048ABAA070ECC13B318CEA31425F4CA3EDD133D350318AC65259E6058C8B32
SHA-512:	CF23513D63AB2192C78CAE98BD3FEA67D933212B630BE111FA7E03BE3E92AF38E247EB2D3804437FD0FDA70FDC87916CD24CF1D3911E9F3BFB2CC4AB72B459BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d...)\|.a.........." .....:...6......`A....................................................`A.........................................l.......m..x....................n...#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\w32-pthreads.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53576
Entropy (8bit):	6.371750593889357
Encrypted:	false
SSDEEP:	1536:ij2SSS5nVoSiH/pOfv3Q3cY37Hx1nI6q:GhSSntiH/pOfvAf3
MD5:	E1EEBD44F9F4B52229D6E54155876056
SHA1:	052CEA514FC3DA5A23DE6541F97CD4D5E9009E58
SHA-256:	D96F2242444A334319B4286403D4BFADAF3F9FCCF390F3DD40BE32FB48CA512A
SHA-512:	235BB9516409A55FE7DDB49B4F3179BDCA406D62FD0EC1345ACDDF032B0F3F111C43FF957D4D09AD683D39449C0FFC4C050B387507FADF5384940BD973DAB159
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.<.K.o.K.o.K.o.3.o.K.oK7.n.K.oK7so.K.oK7.n.K.oK7.n.K.oK7.n.K.o'9.n.K.o.K.o.K.o,6.n.K.o,6.n.K.o,6qo.K.o.K.o.K.o,6.n.K.oRich.K.o........PE..d....Q............" ...#.b...J.......f............................................../.....`............................................X...(...........................H'......8.......p...........................P...@...............@............................text...ha.......b.................. ..`.rdata..P,...........f..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..8...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\zlib.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	144200
Entropy (8bit):	6.592048391646652
Encrypted:	false
SSDEEP:	1536:GjxOs8gLeu4iSssNiTh9Yks32X3KqVy5SmBolzXfqLROJA0o1ZXMvr7Rn6dheIOI:I34iDsG5vm4bfqFKoDmr7h2MHTtwV6K
MD5:	3A0DBC5701D20AA87BE5680111A47662
SHA1:	BC581374CA1EBE8565DB182AC75FB37413220F03
SHA-256:	D53BC4348AD6355C20F75ED16A2F4F641D24881956A7AE8A0B739C0B50CF8091
SHA-512:	4740945606636C110AB6C365BD1BE6377A2A9AC224DE6A79AA506183472A9AD0641ECC63E5C5219EE8097ADEF6533AB35E2594D6F8A91788347FDA93CDB0440E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...&............P....................................................`... ......................................0..\|....@..8....p..................H'......................................(....................A..p............................text...............................`..`.data...............................@....rdata...W.......X..................@..@.pdata..............................@..@.xdata..............................@..@.bss......... ...........................edata..\|....0......................@..@.idata..8....@......................@....CRT....X....P......................@....tls.........`......................@....rsrc........p......................@....reloc..............................@..B................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Installer\{8373D77F-FFF1-454F-A9BC-057E48DE9D80}\icon_31.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 96x96, 32 bits/pixel, 72x72, 32 bits/pixel
Category:	dropped
Size (bytes):	74814
Entropy (8bit):	4.222546221932802
Encrypted:	false
SSDEEP:	384:ZjEycsRokXVkGKlrBRRRR/ur/f4C2+27g6Do:ZNcs/VkhlYf4CffG
MD5:	32BC544E3EB5F62017DDB0E8E22F3048
SHA1:	4CAB98A7CABD3C9D6FC99AD1E4663BC06C7D73CF
SHA-256:	FAF4A3D5669725D2059158A4039BB03E0A599685C61794687E14D21F3F271132
SHA-512:	294AACF59822FE78C0E6D3178988E313A3E42BE997162C77581E9BE334F926881F10A955AA337549CE5889DFA51AB188767521C3B23AD27276EDC1F97FD7D8D1
Malicious:	false
Preview:	......``.... .....V...HH.... ..T......00.... ..%...... .... ............... .h.......(...`......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\4c6f13.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}, Number of Words: 10, Subject: Joas App, Author: Barsoc Quite Sols, Name of Creating Application: Joas App, Template: x64;2057, Comments: This installer database contains the logic and data required to install Joas App., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Jan 15 12:32:58 2025, Last Saved Time/Date: Wed Jan 15 12:32:58 2025, Last Printed: Wed Jan 15 12:32:58 2025, Number of Pages: 450
Category:	dropped
Size (bytes):	60619566
Entropy (8bit):	7.217281824722856
Encrypted:	false
SSDEEP:	786432:RQ2wxVmrjV7eIAte6OTZeoh7Dam7q6Zy8GVZnBXfj4h/:RQRVmrjV7eIv6OTZecaIqiy8KBXfj4N
MD5:	FC2FCA2711E9FF2C2D5919F4C27CD1A1
SHA1:	1D0A411878F9EBC1C5C7DA1B2FE812C295A37CBD
SHA-256:	52341ADB87A5E79D06901A64002C494E3F431C378193982C30225EAB3B136688
SHA-512:	1867D1B64970FFC23505BDD9BEC9F6F6E62E2EE6079C3905881C4BDEC3EDC1655E5F34C54A54C527EEDAB3A42C4B512843C07D6F4374A90C86BC532641F300FA
Malicious:	false
Preview:	......................>............................................2..................................................................x...............................................................................................................................................%...&...'...(...)......................................................Z"..."..E#..F#..G#..H#..I#..J#..K#..L#..M#..N#..O#..P#..Q#..R#..S#..T#..U#...+...+...,...,...,...,...,...,...,..-0...0../0..00...2...2...2...2...2...2...2...2..............d...........................8...............B................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-...7.../...0...1...2...3...4...5...6.......9...M...:...;...<...=...>...?...@...A...D...C...J...E...F...G...H...I...X...K...L...e...N...O...P...Q...R...S...T...U...V...W...("..""..Z...[...\...]...^..._...`...a...b...c.......~...f...g...h...i...j...k...l...m...n...o...p...q...r.......t...u...v...w...x...y...z...

C:\Windows\Installer\4c6f16.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}, Number of Words: 10, Subject: Joas App, Author: Barsoc Quite Sols, Name of Creating Application: Joas App, Template: x64;2057, Comments: This installer database contains the logic and data required to install Joas App., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Jan 15 12:32:58 2025, Last Saved Time/Date: Wed Jan 15 12:32:58 2025, Last Printed: Wed Jan 15 12:32:58 2025, Number of Pages: 450
Category:	dropped
Size (bytes):	60619566
Entropy (8bit):	7.217281824722856
Encrypted:	false
SSDEEP:	786432:RQ2wxVmrjV7eIAte6OTZeoh7Dam7q6Zy8GVZnBXfj4h/:RQRVmrjV7eIv6OTZecaIqiy8KBXfj4N
MD5:	FC2FCA2711E9FF2C2D5919F4C27CD1A1
SHA1:	1D0A411878F9EBC1C5C7DA1B2FE812C295A37CBD
SHA-256:	52341ADB87A5E79D06901A64002C494E3F431C378193982C30225EAB3B136688
SHA-512:	1867D1B64970FFC23505BDD9BEC9F6F6E62E2EE6079C3905881C4BDEC3EDC1655E5F34C54A54C527EEDAB3A42C4B512843C07D6F4374A90C86BC532641F300FA
Malicious:	false
Preview:	......................>............................................2..................................................................x...............................................................................................................................................%...&...'...(...)......................................................Z"..."..E#..F#..G#..H#..I#..J#..K#..L#..M#..N#..O#..P#..Q#..R#..S#..T#..U#...+...+...,...,...,...,...,...,...,..-0...0../0..00...2...2...2...2...2...2...2...2..............d...........................8...............B................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-...7.../...0...1...2...3...4...5...6.......9...M...:...;...<...=...>...?...@...A...D...C...J...E...F...G...H...I...X...K...L...e...N...O...P...Q...R...S...T...U...V...W...("..""..Z...[...\...]...^..._...`...a...b...c.......~...f...g...h...i...j...k...l...m...n...o...p...q...r.......t...u...v...w...x...y...z...

C:\Windows\Installer\MSI778F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI77FE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI783D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI786D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI78AD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1201504
Entropy (8bit):	6.4557937684843365
Encrypted:	false
SSDEEP:	24576:W4FsQxRqkY1ngOktwC2Tec+4VGWSlnH/YrjPWeTIUGVUrHtAkJMsFUh29BKjxw:D2QxNwCsec+4VGWSlnfYvO3UGVUrHtAg
MD5:	E83D774F643972B8ECCDB3A34DA135C5
SHA1:	A58ECCFB12D723C3460563C5191D604DEF235D15
SHA-256:	D0A6F6373CFB902FCD95BC12360A9E949F5597B72C01E0BD328F9B1E2080B5B7
SHA-512:	CB5FF0E66827E6A1FA27ABDD322987906CFDB3CDB49248EFEE04D51FEE65E93B5D964FF78095866E197448358A9DE9EC7F45D4158C0913CBF0DBD849883A6E90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............@G..@G..@G.yCF..@G.yEF..@G.\|CF..@G.\|DF..@G.\|EF..@G.yDF..@G.yAF..@G..AG..@G.}IF..@G.}@F..@G.}.G..@G...G..@G.}BF..@GRich..@G........PE..L...'.$g.........."!...).~..........Pq.......................................`......0.....@A........................ ...t...............................`=.......l......p........................... ...@...............L............................text...J}.......~.................. ..`.rdata...;.......<..................@..@.data...............................@....fptable............................@....rsrc...............................@..@.reloc...l.......n..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI790B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI793B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9715.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	380520
Entropy (8bit):	6.512348002260683
Encrypted:	false
SSDEEP:	6144:ZSXJmYiFGLzkhEFeCPGi5B8dZ6t+6bUSfcqKgAST:ZSXJ9khElPGvcttbxpAST
MD5:	FFDAACB43C074A8CB9A608C612D7540B
SHA1:	8F054A7F77853DE365A7763D93933660E6E1A890
SHA-256:	7484797EA4480BC71509FA28B16E607F82323E05C44F59FFA65DB3826ED1B388
SHA-512:	A9BD31377F7A6ECF75B1D90648847CB83D8BD65AD0B408C4F8DE6EB50764EEF1402E7ACDFF375B7C3B07AC9F94184BD399A10A22418DB474908B5E7A1ADFE263
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?{..?{..?{..x..?{..~..?{...x..?{......?{...~..?{.....?{..z..?{..?z..>{..r..?{..{..?{....?{..?.?{..y..?{.Rich.?{.........PE..L...>.$g.........."!...)..................... .......................................'....@A........................@3..X....3.......... ...............h:.......6..@...p...............................@............ ..(............................text...J........................... ..`.rdata...$... ...&..................@..@.data....!...P......................@....fptable.............@..............@....rsrc... ............B..............@..@.reloc...6.......8...\..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9D30.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	93971
Entropy (8bit):	4.974083109842262
Encrypted:	false
SSDEEP:	384:nYdIq+Jgw9WTDYx7jEycsRokXVkGKlrBRRRR/ur/f4C2+27g6DoM2i5:n+Iq+JL9WTDYZNcs/VkhlYf4CffG2g
MD5:	7D66AFF56B6CC752FB663E406CD64A86
SHA1:	8F892F387F037D4AF37115A1D5AEF15469E17EB9
SHA-256:	1737598DFB2EFC6E368E54C9531B6CD474A3CEC40B2FDA0990A896A73FF749C4
SHA-512:	905229BFB8309EEF2821DE6C1173AC8E2A176178E27D75221DCA5994A5C1A8E3840D45965D96859AF6D4B13383BFA6BDA44EA4F98EC8D21CABAED3C6D6A525C8
Malicious:	false
Preview:	...@IXOS.@.....@OQ/Z.@.....@.....@.....@.....@.....@......&.{8373D77F-FFF1-454F-A9BC-057E48DE9D80}..Joas App..setup.msi.@.....@.....@.....@......icon_31.exe..&.{B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}.....@.....@.....@.....@.......@.....@.....@.......@......Joas App......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@2....@.....@.]....&.{F39C344E-A83E-4760-8DA8-F27602095B4F};.C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\.@.......@.....@.....@......&.{BC83E781-7DE2-47A8-97C3-2E6CC9BCAD82}/.21:\Software\Barsoc Quite Sols\Joas App\Version.@.......@.....@.....@......&.{279C32E3-A00A-4513-9A8B-D3984A41A6FB}D.C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\utest.dll.@.......@.....@.....@......&.{B61B35E4-8BE1-4171-B69B-E2423CE9179F}K.C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\vcruntime140.dll.@.......@.....@.....@......&.{FDDB96EE-847D-4B25-85B1

C:\Windows\Installer\MSI9D31.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	787808
Entropy (8bit):	6.693392695195763
Encrypted:	false
SSDEEP:	24576:aE33f8zyjmfyY43pNRmkL7mh0lhSMXlEeGXDMGz+:L3fSyjmfyY43pNRp7T0eGwGz+
MD5:	8CF47242B5DF6A7F6D2D7AF9CC3A7921
SHA1:	B51595A8A113CF889B0D1DD4B04DF16B3E18F318
SHA-256:	CCB57BDBB19E1AEB2C8DD3845CDC53880C1979284E7B26A1D8AE73BBEAF25474
SHA-512:	748C4767D258BFA6AD2664AA05EF7DC16F2D204FAE40530430EF5D1F38C8F61F074C6EC6501489053195B6B6F6E02D29FDE970D74C6AE97649D8FE1FD342A288
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m..m..m.'n..m.'h.q.m.'i..m.."i..m.."n..m.."h..m.'l..m..l..m.#d..m.#m..m.#...m.....m.#o..m.Rich.m.........PE..L.....$g.........."!...).....4............................................... ............@A........................@J.......J..........................`=......4`...~..p........................... ~..@............................................text............................... ..`.rdata..Z...........................@..@.data...D-...`.......B..............@....fptable.............^..............@....rsrc................`..............@..@.reloc..4`.......b...f..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{8373D77F-FFF1-454F-A9BC-057E48DE9D80}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1614929551120123
Encrypted:	false
SSDEEP:	12:JSbX72FjumSAGiLIlHVRpMh/7777777777777777777777777vDHFicp3Xl0i8Q:JqQI5cEe6F
MD5:	CA02326FD7C446453CB8D9142D8751F0
SHA1:	74B1129C0E52A920B9C7AD96E1923378B41C76F8
SHA-256:	1FB7AC98160947348EAFA593DE1C360531D70A56BE8166286C90D47F4711EF1A
SHA-512:	AC1F4BC34FFC5CC7A35FDA2BFC198E145F1C6B0193439A9870B2C69C3015112C1FF800458D7425CF9CF05D6DD40DF4F1968EF04C3E64BF6EFC082224A18D7B22
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5682489936742412
Encrypted:	false
SSDEEP:	48:v8Ph4uRc06WXJ8nT5zCSMoAErCyqS9bXwSETa3:uh41fnTo5wCBiXwe
MD5:	CADE4849E392AE787489E42234A3821F
SHA1:	F6BE40E1E81FE9A708EBF5FFCE0199B0304955FC
SHA-256:	CA4608925D13A1587320B49A56BA6351BE81F19DFC6856B1AD38202068E755E8
SHA-512:	16C743A9064D3A37800DAEB72374B3BDE48668F47A006BD45F4AAFD2EFFAB0287135329F0EA61595579A2E9A983533F7253479894FBCA7E1F588799780393F46
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365492501184466
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauK:zTtbmkExhMJCIpE5
MD5:	B683F7A239C476001D1DEC18B2508E5A
SHA1:	478E8A2325D05074CB1B00E6B1892A406980C79D
SHA-256:	A8B0A1219A456BBB86607B17DE34C3DD17DC4359EDBD6A67ED456FD477AA928B
SHA-512:	ADC18FCEFB4F584879052DF043143C85285DE49BA7C34075C15638C8ADBD69164CFD451B5F446495EA4BB7ECC47FBD4652853C0AA6ABF4FFEA3FC47AE0DB20B0
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF3A92D711897EA323.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF45E986A8C2542CBF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.256281733167795
Encrypted:	false
SSDEEP:	48:uVwuuBM+CFXJTT5EdCSMoAErCyqS9bXwSETa3:CwfgrTuI5wCBiXwe
MD5:	CCF8DC327F312C4A53E989E8654C6420
SHA1:	D099EA246A0269D30F2945297D668791077A98E4
SHA-256:	A53DD59CBB12A8CF3AD6A261F463AB579ADE9A5C73F631E2766799EAB3F061C0
SHA-512:	17A3340CAD1CCA8F55B0C71A2B2E835BF84843E8F8065D56BBA4488291BF292D6AAB9C6594D643A2BF2FAA15E72F0F9B5BA9FB63D7DF2C9901A3B359FF7C5B4F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF59217637B1B2CB4E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5682489936742412
Encrypted:	false
SSDEEP:	48:v8Ph4uRc06WXJ8nT5zCSMoAErCyqS9bXwSETa3:uh41fnTo5wCBiXwe
MD5:	CADE4849E392AE787489E42234A3821F
SHA1:	F6BE40E1E81FE9A708EBF5FFCE0199B0304955FC
SHA-256:	CA4608925D13A1587320B49A56BA6351BE81F19DFC6856B1AD38202068E755E8
SHA-512:	16C743A9064D3A37800DAEB72374B3BDE48668F47A006BD45F4AAFD2EFFAB0287135329F0EA61595579A2E9A983533F7253479894FBCA7E1F588799780393F46
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6A3EA6C66735F5E9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF98411967D65CC1BA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA06D146AD808222A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA08FED2D3C677D89.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06882939355479753
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOiCCyVky6l3X:2F0i8n0itFzDHFi93X
MD5:	49F97E52053066B2F3B6BCD8A148B449
SHA1:	FD6007DCEA122716BCFBAF0CB2E8B67D94E378A9
SHA-256:	352D053743AF56D446FCE63190ED623EC097EDFEBB59C8DE12EF8F468ADB6747
SHA-512:	15C974523A7EC6F947AF9BAE30C3A6EAF99C6DF91D57277DC6749F5AB4765720BF60B37AA78E9B05A2A82DD824E82B822F727AD448C9D808F71010019E1F1E11
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB5D9A40EAB102F10.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.256281733167795
Encrypted:	false
SSDEEP:	48:uVwuuBM+CFXJTT5EdCSMoAErCyqS9bXwSETa3:CwfgrTuI5wCBiXwe
MD5:	CCF8DC327F312C4A53E989E8654C6420
SHA1:	D099EA246A0269D30F2945297D668791077A98E4
SHA-256:	A53DD59CBB12A8CF3AD6A261F463AB579ADE9A5C73F631E2766799EAB3F061C0
SHA-512:	17A3340CAD1CCA8F55B0C71A2B2E835BF84843E8F8065D56BBA4488291BF292D6AAB9C6594D643A2BF2FAA15E72F0F9B5BA9FB63D7DF2C9901A3B359FF7C5B4F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBC8FAD77BCD6580F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5682489936742412
Encrypted:	false
SSDEEP:	48:v8Ph4uRc06WXJ8nT5zCSMoAErCyqS9bXwSETa3:uh41fnTo5wCBiXwe
MD5:	CADE4849E392AE787489E42234A3821F
SHA1:	F6BE40E1E81FE9A708EBF5FFCE0199B0304955FC
SHA-256:	CA4608925D13A1587320B49A56BA6351BE81F19DFC6856B1AD38202068E755E8
SHA-512:	16C743A9064D3A37800DAEB72374B3BDE48668F47A006BD45F4AAFD2EFFAB0287135329F0EA61595579A2E9A983533F7253479894FBCA7E1F588799780393F46
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC92DB81CE005BA7D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCB553BB883741C22.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.256281733167795
Encrypted:	false
SSDEEP:	48:uVwuuBM+CFXJTT5EdCSMoAErCyqS9bXwSETa3:CwfgrTuI5wCBiXwe
MD5:	CCF8DC327F312C4A53E989E8654C6420
SHA1:	D099EA246A0269D30F2945297D668791077A98E4
SHA-256:	A53DD59CBB12A8CF3AD6A261F463AB579ADE9A5C73F631E2766799EAB3F061C0
SHA-512:	17A3340CAD1CCA8F55B0C71A2B2E835BF84843E8F8065D56BBA4488291BF292D6AAB9C6594D643A2BF2FAA15E72F0F9B5BA9FB63D7DF2C9901A3B359FF7C5B4F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF3C7A797E5A0F76F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.13865103930815698
Encrypted:	false
SSDEEP:	24:VPJZRvTx0VipV0703MoAEV0yjCyqipV0sVQwGcr808U+j:t3JTQS5MoAErCyqS9bXVU
MD5:	C67C4220A28BF83A20926DB0D4A0BA2B
SHA1:	1BD88B229DD4C6B2A1C4033790706F8B0039AA5F
SHA-256:	F4B5771AA92A4A15CA0E9CC058FC17CA85C84F94F1FAA0A579C9DF66B6EEA7C3
SHA-512:	BFBD0ADD6DB85F2CA5E518B0E9A00F8E7A8549CA6E39E180C7792537E665AA4D18C91E6EE8FA5F194D7B74890A4535D117DC9C422A5230611B87742FE3079C9F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	638
Entropy (8bit):	4.751962275036146
Encrypted:	false
SSDEEP:	12:ku/L92WF4gx9l+jsPczo/CdaD0gwiSrlEX6OPkRVdoaQLeU4wv:ku/h5F4Bs0oCdalwisCkRVKVeU4wv
MD5:	15CA959638E74EEC47E0830B90D0696E
SHA1:	E836936738DCB6C551B6B76054F834CFB8CC53E5
SHA-256:	57F2C730C98D62D6C84B693294F6191FD2BEC7D7563AD9963A96AE87ABEBF9EE
SHA-512:	101390C5D2FA93162804B589376CF1E4A1A3DD4BDF4B6FE26D807AFC3FF80DA26EE3BAEB731D297A482165DE7CA48508D6EAA69A5509168E9CEF20B4A88A49FD
Malicious:	false
Preview:	[createdump] createdump [options] pid..-f, --name - dump path and file name. The default is '%TEMP%\dump.%p.dmp'. These specifiers are substituted with following values:.. %p PID of dumped process... %e The process executable filename... %h Hostname return by gethostname()... %t Time of dump, expressed as seconds since the Epoch, 1970-01-01 00:00:00 +0000 (UTC)...-n, --normal - create minidump...-h, --withheap - create minidump with heap (default)...-t, --triage - create triage minidump...-u, --full - create full core dump...-d, --diag - enable diagnostic messages...-v, --verbose - enable verbose diagnostic messages...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {B33EC93A-7963-48BA-BFFE-FA8E09A16C9E}, Number of Words: 10, Subject: Joas App, Author: Barsoc Quite Sols, Name of Creating Application: Joas App, Template: x64;2057, Comments: This installer database contains the logic and data required to install Joas App., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Jan 15 12:32:58 2025, Last Saved Time/Date: Wed Jan 15 12:32:58 2025, Last Printed: Wed Jan 15 12:32:58 2025, Number of Pages: 450
Entropy (8bit):	7.217281824722856
TrID:	Windows SDK Setup Transform Script (63028/2) 88.73% Generic OLE2 / Multistream Compound File (8008/1) 11.27%
File name:	setup.msi
File size:	60'619'566 bytes
MD5:	fc2fca2711e9ff2c2d5919f4c27cd1a1
SHA1:	1d0a411878f9ebc1c5c7da1b2fe812c295a37cbd
SHA256:	52341adb87a5e79d06901a64002c494e3f431c378193982c30225eab3b136688
SHA512:	1867d1b64970ffc23505bdd9bec9f6f6e62e2ee6079c3905881c4bdec3edc1655e5f34c54a54c527eedab3a42c4b512843c07d6f4374a90c86bc532641f300fa
SSDEEP:	786432:RQ2wxVmrjV7eIAte6OTZeoh7Dam7q6Zy8GVZnBXfj4h/:RQRVmrjV7eIv6OTZecaIqiy8KBXfj4N
TLSH:	A8D76C01B3FA4148F2F75E717EBA45A594BABD521B30C0EF1244A60E1B72BC25BB1763
File Content Preview:	........................>............................................2..................................................................x......................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T16:10:28.604111+0100	2829202	ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA	1	192.168.2.5	49704	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:10:28.089534998 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.089560032 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:28.089639902 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.091662884 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.091675043 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:28.561186075 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:28.561302900 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.601450920 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.601471901 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:28.601818085 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:28.601965904 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.603910923 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.604057074 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:28.604084969 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:29.007054090 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:29.007143974 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:29.007145882 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:29.007210016 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:29.007819891 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:29.007819891 CET	49704	443	192.168.2.5	188.114.96.3
Jan 15, 2025 16:10:29.007847071 CET	443	49704	188.114.96.3	192.168.2.5
Jan 15, 2025 16:10:29.008016109 CET	49704	443	192.168.2.5	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 16:10:27.844758987 CET	59783	53	192.168.2.5	1.1.1.1
Jan 15, 2025 16:10:28.084088087 CET	53	59783	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 16:10:27.844758987 CET	192.168.2.5	1.1.1.1	0x453	Standard query (0)	staticmaxepress.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 16:10:28.084088087 CET	1.1.1.1	192.168.2.5	0x453	No error (0)	staticmaxepress.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 16:10:28.084088087 CET	1.1.1.1	192.168.2.5	0x453	No error (0)	staticmaxepress.com		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

staticmaxepress.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.96.3	443	2888	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 15:10:28 UTC	198	OUT	POST /updater2.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvancedInstaller Host: staticmaxepress.com Content-Length: 71 Cache-Control: no-cache
2025-01-15 15:10:28 UTC	71	OUT	Data Raw: 44 61 74 65 3d 31 35 25 32 46 30 31 25 32 46 32 30 32 35 26 54 69 6d 65 3d 31 30 25 33 41 31 30 25 33 41 32 36 26 42 75 69 6c 64 56 65 72 73 69 6f 6e 3d 39 2e 31 2e 34 26 53 6f 72 6f 71 56 69 6e 73 3d 54 72 75 65 Data Ascii: Date=15%2F01%2F2025&Time=10%3A10%3A26&BuildVersion=9.1.4&SoroqVins=True
2025-01-15 15:10:29 UTC	835	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 15 Jan 2025 15:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SKgE22i8dsrPP4DPHsscSsepLBm2CwZBevhaf64OjIbOd0sGKtaHCHoXV0GMfgfq8z9vEo%2BnZ%2F%2BpnMrCMyLmydI1umCfZKwHUHrvNPecoumVQMAgPGbj%2BK06quRJGGgwrcNNmUKa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9026caf51dbe43d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1583&rtt_var=608&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=929&delivery_rate=1779402&cwnd=238&unsent_bytes=0&cid=0cf53c5f53d647c9&ts=463&x=0"
2025-01-15 15:10:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:10:16
Start date:	15/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\setup.msi"
Imagebase:	0x7ff6fe830000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:10:16
Start date:	15/01/2025
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6fe830000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:10:18
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding B91CBCAFE99AE17FCB8B82C57B495F0F
Imagebase:	0x5d0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:10:28
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9DE7.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9DD4.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9DD5.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9DD6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Imagebase:	0x90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:10:28
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:10:35
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\obs-ffmpeg-mux.exe"
Imagebase:	0x7ff65ee10000
File size:	35'656 bytes
MD5 hash:	D3CAC4D7B35BACAE314F48C374452D71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:10:35
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\createdump.exe"
Imagebase:	0x7ff71baa0000
File size:	57'488 bytes
MD5 hash:	71F796B486C7FAF25B9B16233A7CE0CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:10:35
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:10:35
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 073D1B50 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

$p, xrefs: 073D1C32
$p, xrefs: 073D1C3E
$p, xrefs: 073D1BEB

Memory Dump Source

Source File: 00000004.00000002.2241984424.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: $p$$p$$p
API String ID: 0-4193490398
Opcode ID: 937548983778792c3be2d6177882a21aa394ac5bdb7d65b2d9659069cb86e9de
Instruction ID: 7431eab8f07da5e9fbab98ea5ca11572b4865667ef12ee7109fa1e768cb01793
Opcode Fuzzy Hash: 937548983778792c3be2d6177882a21aa394ac5bdb7d65b2d9659069cb86e9de
Instruction Fuzzy Hash: 7C6118B270821A9FEB259F68E4406BA7BE6AF85310F19807AE549CB251DB31CD40C7A1

Function 073D1B35 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

$p, xrefs: 073D1C32
$p, xrefs: 073D1BEB

Memory Dump Source

Source File: 00000004.00000002.2241984424.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: $p$$p
API String ID: 0-580715581
Opcode ID: ee36cc0e474816e26d133ff271fe6fca08fa6fb7f251b132e548b2eda0d2d4e7
Instruction ID: 2f37f7397c95f5dd6c028449334aba5b51017ab08cf2bc642d4670dea4195379
Opcode Fuzzy Hash: ee36cc0e474816e26d133ff271fe6fca08fa6fb7f251b132e548b2eda0d2d4e7
Instruction Fuzzy Hash: EA31CEF2A0420EDFEB24CF25E5807A9B7F6AF41210F1A80A6E44D8B151E375DD84CB91

Function 068B8460 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b412864ad5d98db5c7b1b890a7e2d03dca591fbd876f8f6d8e3eff1d9099e606
Instruction ID: 5f2aefa8b430ff45b24f49f0aed0e396fb9e9649995bbc9ad3e2d4d9060c029a
Opcode Fuzzy Hash: b412864ad5d98db5c7b1b890a7e2d03dca591fbd876f8f6d8e3eff1d9099e606
Instruction Fuzzy Hash: 8BA18A75E002088FDB54DFA4D944AAEBBF6FF84314F258558E902EB364DB74AD49CB80

Function 068B8BB0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1a9ffa23a5572528a376ae4dfffa401f916b1895d8446a0c26798afb95debc
Instruction ID: a57d74410cde2388b7d4f5f572ee76f4577fb650300b78117a913b4ad647b5d5
Opcode Fuzzy Hash: 1a1a9ffa23a5572528a376ae4dfffa401f916b1895d8446a0c26798afb95debc
Instruction Fuzzy Hash: C871EE70A00649CFCB14DF68C884A9EBBF6EF85314F18856AD516DB751DB70AC42CB90

Function 068B8D1E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2dd088832f9f438888bb6c42bd78aa6d6915da244f148c6b745459c1cc35ec3
Instruction ID: 4d1db5b517a6928d02f21e9d99409db5ef2702fb9598294e644d93d1e4ad94c2
Opcode Fuzzy Hash: c2dd088832f9f438888bb6c42bd78aa6d6915da244f148c6b745459c1cc35ec3
Instruction Fuzzy Hash: 85714A70E006489FDB58DFA4D494BAEBBF6BF88304F248529D512EB351DB70AD45CB80

Function 068B8941 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f224055c639c7a28bc6584d7e24866cb6b79975440f153740fc60e88fde7892c
Instruction ID: da7c3bb20490026bf1b5175af45ad15a66c5bbb11af1089fe66560ce765d45c0
Opcode Fuzzy Hash: f224055c639c7a28bc6584d7e24866cb6b79975440f153740fc60e88fde7892c
Instruction Fuzzy Hash: 3151CE79B402008FDB18DB74C855BAE7BF6EF89750F185569D502EB3A0CB34AC41CB90

Function 068B8B9B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896bf9f405239ffc1a63fed24cc57f22f34e40d8aa182215bd41075cc8637871
Instruction ID: 9bbb6f514dee17e84219a6e47dccb8d66d05d3b8f32f55d042945f3d8c904b7f
Opcode Fuzzy Hash: 896bf9f405239ffc1a63fed24cc57f22f34e40d8aa182215bd41075cc8637871
Instruction Fuzzy Hash: 8B418EB0E00648CFDB58DFA5C89479EBBF6BF84304F14856AD406EB751DB70A845CB80

Function 068B3D08 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde6b77be2ca07486a3a635976a1a05e261d0001614e1388659b24e3110c2940
Instruction ID: 4390ce581917c26b6371600c67de95530e33129842a3c281d8ef1da4c2943959
Opcode Fuzzy Hash: cde6b77be2ca07486a3a635976a1a05e261d0001614e1388659b24e3110c2940
Instruction Fuzzy Hash: 724136B4A006099FCB05CF59D594AEEFBB1FF48310B25826AD915AB365C732FC51CBA0

Function 02C1D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2236776867.0000000002C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c264b05210f761ae527a798fa17dec90220ff02d5a1eca1cad8d428d75cefb
Instruction ID: f74d721677d9b7e780065622fd5030c95629c51109a7fa0cf44a45495a099690
Opcode Fuzzy Hash: 78c264b05210f761ae527a798fa17dec90220ff02d5a1eca1cad8d428d75cefb
Instruction Fuzzy Hash: 7E01406140E3C05FD7128B258894B52BFB4DF43224F1980DBD9888F1A7C2699849DBB2

Function 02C1D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2236776867.0000000002C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2c1d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078b39fa4467f73435a33aa1b21f652b45aa8f4a916adc70828c41b88ecebdf8
Instruction ID: 36b525eee175b99e139b387c6cde78fdda3cfd64058548ec1f7d7922453473bd
Opcode Fuzzy Hash: 078b39fa4467f73435a33aa1b21f652b45aa8f4a916adc70828c41b88ecebdf8
Instruction Fuzzy Hash: E001A7715093409EE7204E2ACD85B67BF98DF82364F18C41AED4A0A246C779D946DAF1

Function 068B88D5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2240095063.00000000068B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 068B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafc605d5461516eca8981335047e9cd04b7f64a2b7c0c55daa17de505dcbff4
Instruction ID: 79edc0d2acea662bfda956311749e2a6c5c288e54eac9857db7e81730f202b42
Opcode Fuzzy Hash: fafc605d5461516eca8981335047e9cd04b7f64a2b7c0c55daa17de505dcbff4
Instruction Fuzzy Hash: D9F01C74B4034A8FDB04DBA4C5A5BAE7BB2EB85344F104954D502DF3A8CB789A488BC0

Non-executed Functions

Function 073D1658 Relevance: 15.3, Strings: 12, Instructions: 263COMMON

Download Yara Rule

Strings

Mk, xrefs: 073D173F
tPp, xrefs: 073D1837
Mk, xrefs: 073D174D
84Uk, xrefs: 073D17E0
$p, xrefs: 073D1690
tPp, xrefs: 073D16E1
$p, xrefs: 073D17B4
tPp, xrefs: 073D1843
$p, xrefs: 073D166A
tPp, xrefs: 073D16D5
$p, xrefs: 073D169C
84Uk, xrefs: 073D17EA

Memory Dump Source

Source File: 00000004.00000002.2241984424.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 84Uk$84Uk$tPp$tPp$tPp$tPp$$p$$p$$p$$p$Mk$Mk
API String ID: 0-2547966830
Opcode ID: 9be5e86f6f9cf25aeff3e8c31969a534997758e4ad193283393534ab2a6d03a3
Instruction ID: aee47021ff05acfe30b95fb90a60b232f169891c2e3ea2d0b6a65ac1e043f8a2
Opcode Fuzzy Hash: 9be5e86f6f9cf25aeff3e8c31969a534997758e4ad193283393534ab2a6d03a3
Instruction Fuzzy Hash: C2815CB37083559FE7218768E81066ABFE6AFC5320F1980ABD549CB351CB71DC41C7A2

Function 073D0898 Relevance: 10.2, Strings: 8, Instructions: 180COMMON

Download Yara Rule

Strings

$p, xrefs: 073D0929
4'p, xrefs: 073D0953
$p, xrefs: 073D08EF
$p, xrefs: 073D0A3E
$p, xrefs: 073D0A62
$p, xrefs: 073D0A56
4'p, xrefs: 073D0947
$p, xrefs: 073D091D

Memory Dump Source

Source File: 00000004.00000002.2241984424.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$$p$$p$$p$$p$$p$$p
API String ID: 0-2834719986
Opcode ID: 35193240542b415a884a8de20094d19128c1d26469c320da88a4220e2692700c
Instruction ID: dac17b8440474f6b4fec7e6ba5a7c243983c87d64b96af5d40a8b55b7942680a
Opcode Fuzzy Hash: 35193240542b415a884a8de20094d19128c1d26469c320da88a4220e2692700c
Instruction Fuzzy Hash: 815125B3704206CFFB284A29E4406AABBA6EFD5A20F24806BD55D87251DB32CC51C7A1

Function 073D044D Relevance: 7.6, Strings: 6, Instructions: 77COMMON

Download Yara Rule

Strings

$p, xrefs: 073D0526
4'p, xrefs: 073D04B3
$p, xrefs: 073D051A
4'p, xrefs: 073D0547
4'p, xrefs: 073D053B
4'p, xrefs: 073D04BF

Memory Dump Source

Source File: 00000004.00000002.2241984424.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$$p$$p
API String ID: 0-724797342
Opcode ID: 27cea1ea8e0071f772853c7ba6242cdd5d2d8ecff98afeb5b1cc6de86f6c9cbd
Instruction ID: c149139d222bf702354aba13724fbc6f3db8a143462ee192c7edb5f97fbebdf4
Opcode Fuzzy Hash: 27cea1ea8e0071f772853c7ba6242cdd5d2d8ecff98afeb5b1cc6de86f6c9cbd
Instruction Fuzzy Hash: 2E215EF370C7524FE72E113874215B96BA35FD2A60B2D40ABC489DB346DF658C028793

Function 073D0E88 Relevance: 6.3, Strings: 5, Instructions: 79COMMON

Download Yara Rule

Strings

$p, xrefs: 073D0F00
$p, xrefs: 073D0F0C
$p, xrefs: 073D0ECB
4Tk, xrefs: 073D0F3E
4Tk, xrefs: 073D0F30

Memory Dump Source

Source File: 00000004.00000002.2241984424.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4Tk$4Tk$$p$$p$$p
API String ID: 0-421947537
Opcode ID: fabe661acea9719a8b5a9d424a59b5997065c9abe26fdab06916b954097059b2
Instruction ID: 05446c7caffb6561244912ef965a99e22cec5ba654f846e2201065f1d9e3104c
Opcode Fuzzy Hash: fabe661acea9719a8b5a9d424a59b5997065c9abe26fdab06916b954097059b2
Instruction Fuzzy Hash: 5A11D5F23142069BE6285579F8507BBAACA9BC5A51F24803EE559C6282DF75CC018372

Analysis Process: obs-ffmpeg-mux.exePID: 1292, Parent PID: 6460COMMON

Non-executed Functions

Function 00007FF8A7D6B840 Relevance: 372.3, APIs: 121, Strings: 91, Instructions: 1269libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF8A7D6B86D
free.MSVCRT ref: 00007FF8A7D6B876
calloc.MSVCRT ref: 00007FF8A7D6B885
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D6B8C8
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D6B90A
GetModuleHandleW.KERNEL32 ref: 00007FF8A7D6B913
GetProcAddress.KERNEL32 ref: 00007FF8A7D6B92A
LoadLibraryExW.KERNEL32 ref: 00007FF8A7D6B940
_aligned_free.MSVCRT ref: 00007FF8A7D6B94C
GetProcAddress.KERNEL32 ref: 00007FF8A7D6B98A
GetProcAddress.KERNEL32 ref: 00007FF8A7D6B9C1
GetProcAddress.KERNEL32 ref: 00007FF8A7D6B9F9
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BA31
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BA69
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BAA1
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BAD9
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BB11
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BB49
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BB81
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BBB9
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BBF1
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BC29
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BC61
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BC99
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BCD1
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BD0C
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BD47
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BD82
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BDBD
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BDF8
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BE33
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BE6E
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BEA9
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BEE4
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BF1F
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BF5A
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BF95
GetProcAddress.KERNEL32 ref: 00007FF8A7D6BFD0
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C00B
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C046
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C081
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C0BC
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C0F7
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C132
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C16D
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C1A8
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C1E3
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C21E
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C259
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C294
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C2CF
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C30A
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C345
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C380
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C3BB
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C3F6
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C431
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C46C
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C4A7
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C4E2
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C51D
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C558
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C593
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C5CE
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C609
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C644
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C67F
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C6BA
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C6F5
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C730
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C76B
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C7A6
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C7DE
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C819
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C854
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C88F
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C8CA
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C905
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C940
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C97B
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C9B6
GetProcAddress.KERNEL32 ref: 00007FF8A7D6C9F1
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CA2C
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CA67
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CAA2
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CADD
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CB18
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CB53
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CB8E
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CBC9
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CC04
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CC3F
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CC7A
_errno.MSVCRT ref: 00007FF8A7D6CCBA
GetModuleHandleW.KERNEL32 ref: 00007FF8A7D6CCD7
GetProcAddress.KERNEL32 ref: 00007FF8A7D6CCEE
LoadLibraryExA.KERNEL32 ref: 00007FF8A7D6CD08
FreeLibrary.KERNEL32 ref: 00007FF8A7D6CD4B
free.MSVCRT ref: 00007FF8A7D6CD54
_aligned_free.MSVCRT ref: 00007FF8A7D6D0AA
_aligned_free.MSVCRT ref: 00007FF8A7D6D0B1

Strings

cuDestroyExternalSemaphore, xrefs: 00007FF8A7D6C974, 00007FF8A7D6C97D
Loaded lib: %s, xrefs: 00007FF8A7D6B968
cuEGLStreamProducerConnect, xrefs: 00007FF8A7D6CAD6, 00007FF8A7D6CADF
cuModuleUnload, xrefs: 00007FF8A7D6C4DB, 00007FF8A7D6C4E4
cuEventQuery, xrefs: 00007FF8A7D6C303, 00007FF8A7D6C30C
cuDeviceComputeCapability, xrefs: 00007FF8A7D6BA9A, 00007FF8A7D6BAA3
cuD3D11GetDevice, xrefs: 00007FF8A7D6CBFD, 00007FF8A7D6CC06
cuArray3DCreate_v2, xrefs: 00007FF8A7D6CA60, 00007FF8A7D6CA69
cuDeviceGetCount, xrefs: 00007FF8A7D6B9BA, 00007FF8A7D6B9C3
cuImportExternalSemaphore, xrefs: 00007FF8A7D6C939, 00007FF8A7D6C942
cuMipmappedArrayDestroy, xrefs: 00007FF8A7D6C8FE, 00007FF8A7D6C907
kernel32.dll, xrefs: 00007FF8A7D6B90C, 00007FF8A7D6CCD0
cuCtxPopCurrent_v2, xrefs: 00007FF8A7D6BB7A, 00007FF8A7D6BB83
cuTexObjectCreate, xrefs: 00007FF8A7D6C58C, 00007FF8A7D6C595
cuD3D11GetDevices, xrefs: 00007FF8A7D6CC38, 00007FF8A7D6CC41
cuModuleLoadData, xrefs: 00007FF8A7D6C4A0, 00007FF8A7D6C4A9
cuEGLStreamConsumerDisconnect, xrefs: 00007FF8A7D6CB4C, 00007FF8A7D6CB55
cuModuleGetGlobal, xrefs: 00007FF8A7D6C551, 00007FF8A7D6C55A
cuMemsetD8Async, xrefs: 00007FF8A7D6BC92, 00007FF8A7D6BC9B
cuWaitExternalSemaphoresAsync, xrefs: 00007FF8A7D6C9EA, 00007FF8A7D6C9F3
cuGLGetDevices_v2, xrefs: 00007FF8A7D6C602, 00007FF8A7D6C60B
cuEGLStreamProducerReturnFrame, xrefs: 00007FF8A7D6CBC2, 00007FF8A7D6CBCB
cuMemcpy2D_v2, xrefs: 00007FF8A7D6BD7B, 00007FF8A7D6BD84
cuMipmappedArrayGetLevel, xrefs: 00007FF8A7D6C8C3, 00007FF8A7D6C8CC
cuStreamAddCallback, xrefs: 00007FF8A7D6C217, 00007FF8A7D6C220
cuMemAllocManaged, xrefs: 00007FF8A7D6BC5A, 00007FF8A7D6BC63
cuLinkComplete, xrefs: 00007FF8A7D6C42A, 00007FF8A7D6C433
cuDeviceGetUuid, xrefs: 00007FF8A7D6C79F, 00007FF8A7D6C7A8
cuGetErrorName, xrefs: 00007FF8A7D6BF53, 00007FF8A7D6BF5C
cuDeviceGetName, xrefs: 00007FF8A7D6BA62, 00007FF8A7D6BA6B
cuEventCreate, xrefs: 00007FF8A7D6C252, 00007FF8A7D6C25B
cuSignalExternalSemaphoresAsync, xrefs: 00007FF8A7D6C9AF, 00007FF8A7D6C9B8
cuModuleGetFunction, xrefs: 00007FF8A7D6C516, 00007FF8A7D6C51F
cuArrayCreate_v2, xrefs: 00007FF8A7D6CA25, 00007FF8A7D6CA2E
cuExternalMemoryGetMappedBuffer, xrefs: 00007FF8A7D6C84D, 00007FF8A7D6C856
cuMemAllocPitch_v2, xrefs: 00007FF8A7D6BC22, 00007FF8A7D6BC2B
Loaded sym: %s, xrefs: 00007FF8A7D6B99F, 00007FF8A7D6B9D7, 00007FF8A7D6BA0F, 00007FF8A7D6BA47, 00007FF8A7D6BA7F, 00007FF8A7D6BAB7, 00007FF8A7D6BAEF, 00007FF8A7D6BB27, 00007FF8A7D6BB5F, 00007FF8A7D6BB97, 00007FF8A7D6BBCF, 00007FF8A7D6BC07, 00007FF8A7D6BC3F, 00007FF8A7D6BC77, 00007FF8A7D6BCAF, 00007FF8A7D6BCEA, 00007FF8A7D6BD25, 00007FF8A7D6BD60, 00007FF8A7D6BD9B, 00007FF8A7D6BDD6, 00007FF8A7D6BE11, 00007FF8A7D6BE4C, 00007FF8A7D6BE87, 00007FF8A7D6BEC2, 00007FF8A7D6BEFD, 00007FF8A7D6BF38, 00007FF8A7D6BF73, 00007FF8A7D6BFAE, 00007FF8A7D6BFE9, 00007FF8A7D6C024, 00007FF8A7D6C05F, 00007FF8A7D6C09A, 00007FF8A7D6C0D5, 00007FF8A7D6C110, 00007FF8A7D6C14B, 00007FF8A7D6C186, 00007FF8A7D6C1C1, 00007FF8A7D6C1FC, 00007FF8A7D6C237, 00007FF8A7D6C272, 00007FF8A7D6C2AD, 00007FF8A7D6C2E8, 00007FF8A7D6C323, 00007FF8A7D6C35E, 00007FF8A7D6C399, 00007FF8A7D6C3D4, 00007FF8A7D6C40F, 00007FF8A7D6C44A, 00007FF8A7D6C485, 00007FF8A7D6C4C0, 00007FF8A7D6C4FB, 00007FF8A7D6C536, 00007FF8A7D6C571, 00007FF8A7D6C5AC, 00007FF8A7D6C5E7, 00007FF8A7D6C622, 00007FF8A7D6C65D, 00007FF8A7D6C698, 00007FF8A7D6C6D3, 00007FF8A7D6C70E, 00007FF8A7D6C749, 00007FF8A7D6C784, 00007FF8A7D6C7BC, 00007FF8A7D6C7F7, 00007FF8A7D6C832, 00007FF8A7D6C86D, 00007FF8A7D6C8A8, 00007FF8A7D6C8E3, 00007FF8A7D6C91E, 00007FF8A7D6C959, 00007FF8A7D6C994, 00007FF8A7D6C9CF, 00007FF8A7D6CA0A, 00007FF8A7D6CA45, 00007FF8A7D6CA80, 00007FF8A7D6CABB, 00007FF8A7D6CAF6, 00007FF8A7D6CB31, 00007FF8A7D6CB6C, 00007FF8A7D6CBA7, 00007FF8A7D6CBE2, 00007FF8A7D6CC1D, 00007FF8A7D6CC58, 00007FF8A7D6CC93
cuTexObjectDestroy, xrefs: 00007FF8A7D6C5C7, 00007FF8A7D6C5D0
cuEGLStreamProducerDisconnect, xrefs: 00007FF8A7D6CB11, 00007FF8A7D6CB1A
cuLaunchKernel, xrefs: 00007FF8A7D6C379, 00007FF8A7D6C382
cuGraphicsSubResourceGetMappedArray, xrefs: 00007FF8A7D6C729, 00007FF8A7D6C732
cuDevicePrimaryCtxRelease, xrefs: 00007FF8A7D6C03F, 00007FF8A7D6C048
cuMemcpyDtoD_v2, xrefs: 00007FF8A7D6BEDD, 00007FF8A7D6BEE6
cuCtxDestroy_v2, xrefs: 00007FF8A7D6BBB2, 00007FF8A7D6BBBB
cuGraphicsD3D11RegisterResource, xrefs: 00007FF8A7D6CC73, 00007FF8A7D6CC7C
cuCtxCreate_v2, xrefs: 00007FF8A7D6BAD2, 00007FF8A7D6BADB
cuEGLStreamProducerPresentFrame, xrefs: 00007FF8A7D6CB87, 00007FF8A7D6CB90
nvcuda.dll, xrefs: 00007FF8A7D6B8C1, 00007FF8A7D6B8F9, 00007FF8A7D6B961, 00007FF8A7D6CD01, 00007FF8A7D6D0C1
cuMemcpyHtoDAsync_v2, xrefs: 00007FF8A7D6BE2C, 00007FF8A7D6BE35
cuCtxPushCurrent_v2, xrefs: 00007FF8A7D6BB42, 00007FF8A7D6BB4B
cuLinkDestroy, xrefs: 00007FF8A7D6C465, 00007FF8A7D6C46E
cuGetErrorString, xrefs: 00007FF8A7D6BF8E, 00007FF8A7D6BF97
cuStreamCreate, xrefs: 00007FF8A7D6C12B, 00007FF8A7D6C134
cuStreamSynchronize, xrefs: 00007FF8A7D6C1A1, 00007FF8A7D6C1AA
cuDevicePrimaryCtxGetState, xrefs: 00007FF8A7D6C0B5, 00007FF8A7D6C0BE
Cannot load optional %s, xrefs: 00007FF8A7D6CD70, 00007FF8A7D6CD90, 00007FF8A7D6CDB0, 00007FF8A7D6CDD0, 00007FF8A7D6CDF0, 00007FF8A7D6CE10, 00007FF8A7D6CE30, 00007FF8A7D6CE50, 00007FF8A7D6CE70, 00007FF8A7D6CE90, 00007FF8A7D6CEB0, 00007FF8A7D6CED0, 00007FF8A7D6CEF0, 00007FF8A7D6CF10, 00007FF8A7D6CF30, 00007FF8A7D6CF50
cuEventRecord, xrefs: 00007FF8A7D6C33E, 00007FF8A7D6C347
cuCtxSetLimit, xrefs: 00007FF8A7D6BB0A, 00007FF8A7D6BB13
SetDefaultDllDirectories, xrefs: 00007FF8A7D6B920, 00007FF8A7D6CCE4
cuMemcpyDtoDAsync_v2, xrefs: 00007FF8A7D6BF18, 00007FF8A7D6BF21
cuMemcpyAsync, xrefs: 00007FF8A7D6BD40, 00007FF8A7D6BD49
cuMemcpy, xrefs: 00007FF8A7D6BD05, 00007FF8A7D6BD0E
cuGraphicsUnregisterResource, xrefs: 00007FF8A7D6C678, 00007FF8A7D6C681
cuMemAlloc_v2, xrefs: 00007FF8A7D6BBEA, 00007FF8A7D6BBF3
cuStreamDestroy_v2, xrefs: 00007FF8A7D6C1DC, 00007FF8A7D6C1E5
cuDevicePrimaryCtxReset, xrefs: 00007FF8A7D6C0F0, 00007FF8A7D6C0F9
cuDevicePrimaryCtxSetFlags, xrefs: 00007FF8A7D6C07A, 00007FF8A7D6C083
cuLinkAddData, xrefs: 00007FF8A7D6C3EF, 00007FF8A7D6C3F8
cuEventSynchronize, xrefs: 00007FF8A7D6C2C8, 00007FF8A7D6C2D1
cuImportExternalMemory, xrefs: 00007FF8A7D6C7D7, 00007FF8A7D6C7E0
cuDeviceGet, xrefs: 00007FF8A7D6B9F2, 00007FF8A7D6B9FB
cuGraphicsMapResources, xrefs: 00007FF8A7D6C6B3, 00007FF8A7D6C6BC
cuDestroyExternalMemory, xrefs: 00007FF8A7D6C812, 00007FF8A7D6C81B
cuMemcpyDtoHAsync_v2, xrefs: 00007FF8A7D6BEA2, 00007FF8A7D6BEAB
cuExternalMemoryGetMappedMipmappedArray, xrefs: 00007FF8A7D6C888, 00007FF8A7D6C891
cuDeviceGetAttribute, xrefs: 00007FF8A7D6BA2A, 00007FF8A7D6BA33
cuInit, xrefs: 00007FF8A7D6B983, 00007FF8A7D6B98C
cuMemcpyHtoD_v2, xrefs: 00007FF8A7D6BDF1, 00007FF8A7D6BDFA
cuGraphicsGLRegisterImage, xrefs: 00007FF8A7D6C63D, 00007FF8A7D6C646
cuEventDestroy_v2, xrefs: 00007FF8A7D6C28D, 00007FF8A7D6C296
cuGraphicsUnmapResources, xrefs: 00007FF8A7D6C6EE, 00007FF8A7D6C6F7
Cannot load %s, xrefs: 00007FF8A7D6CD20, 00007FF8A7D6D0C8
cuArrayDestroy, xrefs: 00007FF8A7D6CA9B, 00007FF8A7D6CAA4
cuCtxGetDevice, xrefs: 00007FF8A7D6BFC9, 00007FF8A7D6BFD2
cuMemcpyDtoH_v2, xrefs: 00007FF8A7D6BE67, 00007FF8A7D6BE70
cuStreamQuery, xrefs: 00007FF8A7D6C166, 00007FF8A7D6C16F
cuLinkCreate, xrefs: 00007FF8A7D6C3B4, 00007FF8A7D6C3BD
cuMemcpy2DAsync_v2, xrefs: 00007FF8A7D6BDB6, 00007FF8A7D6BDBF
cuMemFree_v2, xrefs: 00007FF8A7D6BCCA, 00007FF8A7D6BCD3
cuDevicePrimaryCtxRetain, xrefs: 00007FF8A7D6C004, 00007FF8A7D6C00D
cuGraphicsResourceGetMappedPointer_v2, xrefs: 00007FF8A7D6C764, 00007FF8A7D6C76D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: AddressProc$Library$_aligned_free$ByteCharFreeHandleLoadModuleMultiWidefree$_errnocalloc
String ID: Cannot load %s$Cannot load optional %s$Loaded lib: %s$Loaded sym: %s$SetDefaultDllDirectories$cuArray3DCreate_v2$cuArrayCreate_v2$cuArrayDestroy$cuCtxCreate_v2$cuCtxDestroy_v2$cuCtxGetDevice$cuCtxPopCurrent_v2$cuCtxPushCurrent_v2$cuCtxSetLimit$cuD3D11GetDevice$cuD3D11GetDevices$cuDestroyExternalMemory$cuDestroyExternalSemaphore$cuDeviceComputeCapability$cuDeviceGet$cuDeviceGetAttribute$cuDeviceGetCount$cuDeviceGetName$cuDeviceGetUuid$cuDevicePrimaryCtxGetState$cuDevicePrimaryCtxRelease$cuDevicePrimaryCtxReset$cuDevicePrimaryCtxRetain$cuDevicePrimaryCtxSetFlags$cuEGLStreamConsumerDisconnect$cuEGLStreamProducerConnect$cuEGLStreamProducerDisconnect$cuEGLStreamProducerPresentFrame$cuEGLStreamProducerReturnFrame$cuEventCreate$cuEventDestroy_v2$cuEventQuery$cuEventRecord$cuEventSynchronize$cuExternalMemoryGetMappedBuffer$cuExternalMemoryGetMappedMipmappedArray$cuGLGetDevices_v2$cuGetErrorName$cuGetErrorString$cuGraphicsD3D11RegisterResource$cuGraphicsGLRegisterImage$cuGraphicsMapResources$cuGraphicsResourceGetMappedPointer_v2$cuGraphicsSubResourceGetMappedArray$cuGraphicsUnmapResources$cuGraphicsUnregisterResource$cuImportExternalMemory$cuImportExternalSemaphore$cuInit$cuLaunchKernel$cuLinkAddData$cuLinkComplete$cuLinkCreate$cuLinkDestroy$cuMemAllocManaged$cuMemAllocPitch_v2$cuMemAlloc_v2$cuMemFree_v2$cuMemcpy$cuMemcpy2DAsync_v2$cuMemcpy2D_v2$cuMemcpyAsync$cuMemcpyDtoDAsync_v2$cuMemcpyDtoD_v2$cuMemcpyDtoHAsync_v2$cuMemcpyDtoH_v2$cuMemcpyHtoDAsync_v2$cuMemcpyHtoD_v2$cuMemsetD8Async$cuMipmappedArrayDestroy$cuMipmappedArrayGetLevel$cuModuleGetFunction$cuModuleGetGlobal$cuModuleLoadData$cuModuleUnload$cuSignalExternalSemaphoresAsync$cuStreamAddCallback$cuStreamCreate$cuStreamDestroy_v2$cuStreamQuery$cuStreamSynchronize$cuTexObjectCreate$cuTexObjectDestroy$cuWaitExternalSemaphoresAsync$kernel32.dll$nvcuda.dll
API String ID: 3405737670-3447704524
Opcode ID: 4af3281c0e25db81b3078cec52e73783fda2d96fdf649ea0d565a5970141e5c3
Instruction ID: 1341b2ee6c015f463db0d471f253f65acdd73e7ea1e50d6dfacd8d0f2a624bf9
Opcode Fuzzy Hash: 4af3281c0e25db81b3078cec52e73783fda2d96fdf649ea0d565a5970141e5c3
Instruction Fuzzy Hash: EED21731A1BA47A0EA41EF20E8612ED2395EF94BC4F844532E91D4B3A9DE3CF515E391

Function 00007FF8A7D6FDF0 Relevance: 140.7, APIs: 62, Strings: 18, Instructions: 667libraryloaderCOMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 00007FF8A7D6FE1E
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D6FE84
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D6FEC6
GetProcAddress.KERNEL32 ref: 00007FF8A7D6FEEE
LoadLibraryExW.KERNEL32 ref: 00007FF8A7D6FF04
_aligned_free.MSVCRT ref: 00007FF8A7D6FF12
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D6FF50
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D6FF9A
GetProcAddress.KERNEL32 ref: 00007FF8A7D6FFB4
LoadLibraryExW.KERNEL32 ref: 00007FF8A7D6FFCA
_aligned_free.MSVCRT ref: 00007FF8A7D6FFD6
GetProcAddress.KERNEL32 ref: 00007FF8A7D6FFF2
GetProcAddress.KERNEL32 ref: 00007FF8A7D700D6
GetDesktopWindow.USER32 ref: 00007FF8A7D7014A
_errno.MSVCRT ref: 00007FF8A7D70220
GetProcAddress.KERNEL32 ref: 00007FF8A7D70256
LoadLibraryExA.KERNEL32 ref: 00007FF8A7D70270
_errno.MSVCRT ref: 00007FF8A7D7027B
GetProcAddress.KERNEL32 ref: 00007FF8A7D702A8
_aligned_free.MSVCRT ref: 00007FF8A7D702B5
_aligned_free.MSVCRT ref: 00007FF8A7D702BC
GetProcAddress.KERNEL32 ref: 00007FF8A7D70398
GetDesktopWindow.USER32 ref: 00007FF8A7D703EB

Strings

d3d9.dll, xrefs: 00007FF8A7D6FE5A, 00007FF8A7D6FEB5, 00007FF8A7D70269
Direct3DCreate9Ex, xrefs: 00007FF8A7D70011
Failed to locate DXVA2CreateDirect3DDeviceManager9, xrefs: 00007FF8A7D7094E
Failed to locate Direct3DCreate9, xrefs: 00007FF8A7D70A50
Failed to bind Direct3D device to device manager, xrefs: 00007FF8A7D7096C
Direct3DCreate9, xrefs: 00007FF8A7D7030F
&, xrefs: 00007FF8A7D70408
dxva2.dll, xrefs: 00007FF8A7D6FF36, 00007FF8A7D6FF89, 00007FF8A7D70598
SetDefaultDllDirectories, xrefs: 00007FF8A7D6FEE4, 00007FF8A7D6FFAA, 00007FF8A7D7024C, 00007FF8A7D7029E
Using D3D9Ex device., xrefs: 00007FF8A7D7019A
Failed to load DXVA2 library, xrefs: 00007FF8A7D702C9
Failed to load D3D9 library, xrefs: 00007FF8A7D705C5
Failed to create IDirect3D object, xrefs: 00007FF8A7D70A18
Failed to create Direct3D device, xrefs: 00007FF8A7D70425
Failed to create Direct3D device manager, xrefs: 00007FF8A7D7098A
DXVA2CreateDirect3DDeviceManager9, xrefs: 00007FF8A7D6FFE8
kernel32.dll, xrefs: 00007FF8A7D6FECF, 00007FF8A7D6FF9C, 00007FF8A7D70237, 00007FF8A7D70290
Failed to open device handle, xrefs: 00007FF8A7D709A8

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: AddressProc$ByteCharMultiWide_aligned_free$LibraryLoad$DesktopWindow_errno$atoi
String ID: &$DXVA2CreateDirect3DDeviceManager9$Direct3DCreate9$Direct3DCreate9Ex$Failed to bind Direct3D device to device manager$Failed to create Direct3D device$Failed to create Direct3D device manager$Failed to create IDirect3D object$Failed to load D3D9 library$Failed to load DXVA2 library$Failed to locate DXVA2CreateDirect3DDeviceManager9$Failed to locate Direct3DCreate9$Failed to open device handle$SetDefaultDllDirectories$Using D3D9Ex device.$d3d9.dll$dxva2.dll$kernel32.dll
API String ID: 1760633067-2418308259
Opcode ID: 1b8f3b45278436593ea4620b683ff6dcafb812b761b95205c1ba724c4eb98057
Instruction ID: 30c3ac21540d95e4003d1fe1a5976fa0b0042d2a3ca559b36e5c1c7a975163e4
Opcode Fuzzy Hash: 1b8f3b45278436593ea4620b683ff6dcafb812b761b95205c1ba724c4eb98057
Instruction Fuzzy Hash: 62528E31A0AB82A2EB50DF11E4143AE67A0FF88BD4F448636D99D4B7D9DF7CE504A740

Function 00007FF65EE12A10 Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 209stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE12A7F
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE12A87
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE12A93
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE12AAA

Part of subcall function 00007FF65EE12320: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FF65EE129D8,?,?,?,00007FF65EE112F1), ref: 00007FF65EE12357

brealloc.OBS ref: 00007FF65EE12AD2
memmove.VCRUNTIME140 ref: 00007FF65EE12B16
pthread_mutex_init.W32-PTHREADS ref: 00007FF65EE12B36
os_event_init.OBS ref: 00007FF65EE12B44
os_event_init.OBS ref: 00007FF65EE12B52
pthread_create.W32-PTHREADS ref: 00007FF65EE12B6A
av_malloc.AVUTIL-58 ref: 00007FF65EE12B74
avio_alloc_context.AVFORMAT-60 ref: 00007FF65EE12BA7
av_dict_parse_string.AVUTIL-58 ref: 00007FF65EE12BDE
av_strerror.AVUTIL-58 ref: 00007FF65EE12C06
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE12C10
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE12C2B
av_dict_free.AVUTIL-58 ref: 00007FF65EE12C34
av_dict_count.AVUTIL-58 ref: 00007FF65EE12C3D
printf.MSPDB140-MSVCRT ref: 00007FF65EE12C4D
av_dict_get.AVUTIL-58 ref: 00007FF65EE12C66
printf.MSPDB140-MSVCRT ref: 00007FF65EE12C8E
av_dict_get.AVUTIL-58 ref: 00007FF65EE12CA7
printf.MSPDB140-MSVCRT ref: 00007FF65EE12CBB
avformat_write_header.AVFORMAT-60 ref: 00007FF65EE12CC7
av_strerror.AVUTIL-58 ref: 00007FF65EE12CF5
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE12CFF
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE12D17
av_dict_free.AVUTIL-58 ref: 00007FF65EE12D20

Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1204A
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12065
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12080
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1209B
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE120B6

avio_open.AVFORMAT-60 ref: 00007FF65EE12D41
av_strerror.AVUTIL-58 ref: 00007FF65EE12D6D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE12D77
av_dict_free.AVUTIL-58 ref: 00007FF65EE12D8A

Strings

Using muxer settings:, xrefs: 00007FF65EE12C46
%s=%s, xrefs: 00007FF65EE12C84
Failed to parse muxer settings: %s%s, xrefs: 00007FF65EE12C24
Error opening '%s': %s, xrefs: 00007FF65EE12D10
Couldn't open '%s', %s, xrefs: 00007FF65EE12AA0

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strncmp$__acrt_iob_func$av_dict_freeav_strerrorfprintfprintf$av_dict_getos_event_init$__stdio_common_vfprintf_errnoav_dict_countav_dict_parse_stringav_mallocavformat_write_headeravio_alloc_contextavio_openbreallocmemmovepthread_createpthread_mutex_initstrerror
String ID: %s=%s$Couldn't open '%s', %s$Error opening '%s': %s$Failed to parse muxer settings: %s%s$Using muxer settings:
API String ID: 2783795328-2826353358
Opcode ID: 0ced714b6d2bafb841ab697dc7cb68e417ab27a254e86fbca716fd3c82a395c5
Instruction ID: aba0e0e9f4052f1f10ee3980999fe8beaefc2fe253cc0fbdfd75a9ac65eb974e
Opcode Fuzzy Hash: 0ced714b6d2bafb841ab697dc7cb68e417ab27a254e86fbca716fd3c82a395c5
Instruction Fuzzy Hash: 33A1A621F24B9295EF18DBA1DA503F86360FB68784F485136FA4DA7645EFBCE1D48340

Function 00007FF65EE12EE0 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF65EE12F39
SetErrorMode.KERNEL32 ref: 00007FF65EE12F5D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE12F6B
WideCharToMultiByte.KERNEL32 ref: 00007FF65EE12FD8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE12FE7
WideCharToMultiByte.KERNEL32 ref: 00007FF65EE13016
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE13044
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE1304D
_setmode.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE1305A
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE13065
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE13077
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE13098
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE130A8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE130F8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE1311C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE13167
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE13177
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE1319A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE131A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE131C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE131D6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE13215
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE13239
av_rescale_q_rnd.AVUTIL-58 ref: 00007FF65EE1330C
av_rescale_q_rnd.AVUTIL-58 ref: 00007FF65EE13344
av_interleaved_write_frame.AVFORMAT-60 ref: 00007FF65EE1336D
av_strerror.AVUTIL-58 ref: 00007FF65EE133BA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE133C4
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE133DE

Part of subcall function 00007FF65EE12320: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FF65EE129D8,?,?,?,00007FF65EE112F1), ref: 00007FF65EE12357

Strings

Couldn't initialize muxer, xrefs: 00007FF65EE130A1, 00007FF65EE13170
av_interleaved_write_frame failed: %d: %s, xrefs: 00007FF65EE133D7

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: __acrt_iob_func$freemalloc$fprintf$ByteCharMultiWideav_rescale_q_rndrealloc$ErrorMode__stdio_common_vfprintf_fileno_setmodeav_interleaved_write_frameav_strerrormemsetsetvbuf
String ID: Couldn't initialize muxer$av_interleaved_write_frame failed: %d: %s
API String ID: 4192084208-164389310
Opcode ID: 90e4d641eae2122b72088982d14054dbbcc6ef952270b6c02c8a2abd6878b3b9
Instruction ID: 217d04ba00869e42dd7c0dd86ac8bff33c8b5a33c8400dc0ad2f1577e9f7d297
Opcode Fuzzy Hash: 90e4d641eae2122b72088982d14054dbbcc6ef952270b6c02c8a2abd6878b3b9
Instruction Fuzzy Hash: 4FE1F422B28A9286EF24CFA1D9403BD67A1FB69B84F094139EE4DA7754DF7CD585C300

Function 00007FF8A7D5C2F0 Relevance: 51.3, APIs: 25, Strings: 4, Instructions: 582stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D5C347
strtol.MSVCRT ref: 00007FF8A7D5C3ED
strchr.MSVCRT ref: 00007FF8A7D5C462
strcmp.MSVCRT ref: 00007FF8A7D5C564
_aligned_free.MSVCRT ref: 00007FF8A7D5C594
_aligned_free.MSVCRT ref: 00007FF8A7D5C59E
_aligned_free.MSVCRT ref: 00007FF8A7D5C5D5

Strings

mono, xrefs: 00007FF8A7D5C317
ambisonic , xrefs: 00007FF8A7D5C3A0
channels, xrefs: 00007FF8A7D5CB80
%d channels (%[^)], xrefs: 00007FF8A7D5C44B

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free$strcmp$strchrstrtol
String ID: channels$%d channels (%[^)]$ambisonic $mono
API String ID: 6235670-221731140
Opcode ID: 9a9eb1e0a00dde1935faf8ff688298a0d262cbf1e4cfcb0e70de2c1dca8238e4
Instruction ID: edf661514844e0f1d4ec2025ec7cab96e3e7e127f7639e5d0c025a6af10da5f3
Opcode Fuzzy Hash: 9a9eb1e0a00dde1935faf8ff688298a0d262cbf1e4cfcb0e70de2c1dca8238e4
Instruction Fuzzy Hash: 13427173A0A6C3A6EB608F15E44037E67A1FB80BC4F54A131DA9D47B99DE7CE441EB40

Function 00007FF8A7D82D90 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 203COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 00007FF8A7D82E0D
_close.MSVCRT ref: 00007FF8A7D82E17
_read.MSVCRT ref: 00007FF8A7D82E48
_close.MSVCRT ref: 00007FF8A7D82E52
clock.MSVCRT ref: 00007FF8A7D82EF9

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7D83080
sizeof(tmp) >= av_sha_size, xrefs: 00007FF8A7D83070
Microsoft Primitive Provider, xrefs: 00007FF8A7D82DA0
src/libavutil/random_seed.c, xrefs: 00007FF8A7D83069
N, xrefs: 00007FF8A7D83087
/dev/urandom, xrefs: 00007FF8A7D82DEC
RNG, xrefs: 00007FF8A7D82DA7
/dev/random, xrefs: 00007FF8A7D82E27

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _close_read$clock
String ID: /dev/random$/dev/urandom$Assertion %s failed at %s:%d$Microsoft Primitive Provider$N$RNG$sizeof(tmp) >= av_sha_size$src/libavutil/random_seed.c
API String ID: 3077350862-4220122895
Opcode ID: 42a263d787bb1900c231adad2bae4144787def7db549a8d8b5a27e8b710399cc
Instruction ID: 66506005b97db970dcd364378813ac9bb35b25c904c7f50deba4176dc2aaa889
Opcode Fuzzy Hash: 42a263d787bb1900c231adad2bae4144787def7db549a8d8b5a27e8b710399cc
Instruction Fuzzy Hash: 76713872B0A64665FB189F34E4512BD3691FF84BC0F405236EA0E97A99EEBCF404D700

Function 00007FF8A7D7F2C0 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 461COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7D7F94F
_errno.MSVCRT ref: 00007FF8A7D7F977

Strings

AliceBlue, xrefs: 00007FF8A7D7F5CD
%Y - %m - %d, xrefs: 00007FF8A7D7F62C
%H%M%S, xrefs: 00007FF8A7D7F6A9
+, xrefs: 00007FF8A7D7F5A4
%J:%M:%S, xrefs: 00007FF8A7D7F331
%H:%M:%S, xrefs: 00007FF8A7D7F68E
%M:%S, xrefs: 00007FF8A7D7F923
%Y%m%d, xrefs: 00007FF8A7D7F64D
%H:%M, xrefs: 00007FF8A7D7F57A
now, xrefs: 00007FF8A7D7F613

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: %H%M%S$%H:%M$%H:%M:%S$%J:%M:%S$%M:%S$%Y - %m - %d$%Y%m%d$+$AliceBlue$now
API String ID: 2918714741-785088730
Opcode ID: 8cc4219109180221a37125365c6cb82e6481bf229ae85591e8e1ba171042397c
Instruction ID: c6da002aa06a91edb96e9d9e12781ba221d723ca3d3fe74ddc782a87a9cb59c0
Opcode Fuzzy Hash: 8cc4219109180221a37125365c6cb82e6481bf229ae85591e8e1ba171042397c
Instruction Fuzzy Hash: E5023972B1E29656FB348F25E44073EAB91EB407C4F548231DA5D07BE8DE3DE506AB00

Function 00007FF8A7D5D9B0 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 272COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D5D9FF

Strings

av_crc_init(av_crc_table[AV_CRC_24_IEEE], 0, 24, 0x864CFB, sizeof(av_crc_table[AV_CRC_24_IEEE])) >= 0, xrefs: 00007FF8A7D5DB5B
src/libavutil/crc.c, xrefs: 00007FF8A7D5D9D4, 00007FF8A7D5DA34, 00007FF8A7D5DA94, 00007FF8A7D5DAF4, 00007FF8A7D5DB54, 00007FF8A7D5DBB4
av_crc_init(av_crc_table[AV_CRC_16_CCITT], 0, 16, 0x1021, sizeof(av_crc_table[AV_CRC_16_CCITT])) >= 0, xrefs: 00007FF8A7D5DAFB
av_crc_init(av_crc_table[AV_CRC_8_ATM], 0, 8, 0x07, sizeof(av_crc_table[AV_CRC_8_ATM])) >= 0, xrefs: 00007FF8A7D5D9DB, 00007FF8A7D5DA3B, 00007FF8A7D5DA9B
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D5D9EB, 00007FF8A7D5DA4B, 00007FF8A7D5DAAB, 00007FF8A7D5DB0B, 00007FF8A7D5DB6B, 00007FF8A7D5DBCB
av_crc_init(av_crc_table[AV_CRC_32_IEEE], 0, 32, 0x04C11DB7, sizeof(av_crc_table[AV_CRC_32_IEEE])) >= 0, xrefs: 00007FF8A7D5DBBB

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$av_crc_init(av_crc_table[AV_CRC_16_CCITT], 0, 16, 0x1021, sizeof(av_crc_table[AV_CRC_16_CCITT])) >= 0$av_crc_init(av_crc_table[AV_CRC_24_IEEE], 0, 24, 0x864CFB, sizeof(av_crc_table[AV_CRC_24_IEEE])) >= 0$av_crc_init(av_crc_table[AV_CRC_32_IEEE], 0, 32, 0x04C11DB7, sizeof(av_crc_table[AV_CRC_32_IEEE])) >= 0$av_crc_init(av_crc_table[AV_CRC_8_ATM], 0, 8, 0x07, sizeof(av_crc_table[AV_CRC_8_ATM])) >= 0$src/libavutil/crc.c
API String ID: 4206212132-2611614167
Opcode ID: 92c9e43b5e3701d523069e98b3d843c3635d7b65042acc036af35ff1e6a13f27
Instruction ID: 1f7b16c087b95d5b935ac5ac19ed859044df8f08543d8bfdd11f836615296200
Opcode Fuzzy Hash: 92c9e43b5e3701d523069e98b3d843c3635d7b65042acc036af35ff1e6a13f27
Instruction Fuzzy Hash: FDA10573F1AA8653E700AF64D8823ED3690EB98788F888235D61DC7695DE3CE159E710

Function 00007FF8A7D6ED32 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 176libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8A7D6ED8A

Strings

Failed to load D3D11 library or its functions, xrefs: 00007FF8A7D6F00B
Using device %04x:%04x (%ls)., xrefs: 00007FF8A7D6EEEF
DXGIGetDebugInterface, xrefs: 00007FF8A7D6EF65
dxgidebug.dll, xrefs: 00007FF8A7D6EF50
d3d11_1sdklayers.dll, xrefs: 00007FF8A7D6ED80
Failed to create Direct3D device (%lx), xrefs: 00007FF8A7D6F02D
debug, xrefs: 00007FF8A7D6ED66

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: LibraryLoad
String ID: DXGIGetDebugInterface$Failed to create Direct3D device (%lx)$Failed to load D3D11 library or its functions$Using device %04x:%04x (%ls).$d3d11_1sdklayers.dll$debug$dxgidebug.dll
API String ID: 1029625771-4247103231
Opcode ID: 5e2a214d2a33974e5b6e87ebf4458333bd18d13c46bc31c7c438c065be5d4816
Instruction ID: fefaffd522aadb5ef96e0532315ed4569dcdfe421a7d7d64a00367f6d265b617
Opcode Fuzzy Hash: 5e2a214d2a33974e5b6e87ebf4458333bd18d13c46bc31c7c438c065be5d4816
Instruction Fuzzy Hash: DD715936B1AA46A2EB10DF26E45076E6360FB84BC8F445232EE5D477A8DF3DE405E740

Function 00007FF8A7D7C650 Relevance: 16.8, APIs: 1, Strings: 10, Instructions: 299COMMON

Download Yara Rule

Strings

default, xrefs: 00007FF8A7D7C784
max, xrefs: 00007FF8A7D7C7C9
none, xrefs: 00007FF8A7D7C7EF
const_values array too small for %s, xrefs: 00007FF8A7D7CB8A
-, xrefs: 00007FF8A7D7CA63
The "%s" option is deprecated: %s, xrefs: 00007FF8A7D7CABE
Unable to parse option value "%s", xrefs: 00007FF8A7D7CBAE
min, xrefs: 00007FF8A7D7C7E0
all, xrefs: 00007FF8A7D7C7FE
%d%*1[:/]%d%c, xrefs: 00007FF8A7D7CB60

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: %d%*1[:/]%d%c$-$The "%s" option is deprecated: %s$Unable to parse option value "%s"$all$const_values array too small for %s$default$max$min$none
API String ID: 0-679463259
Opcode ID: 9d9d9a3b7a0190a60b3e1d7de4052083c20cc3d048e1b11ee78faf5db607be51
Instruction ID: bbdcf072baba761c6da50d7c7347162bf30a999a8dba7306f49b540a28fb52db
Opcode Fuzzy Hash: 9d9d9a3b7a0190a60b3e1d7de4052083c20cc3d048e1b11ee78faf5db607be51
Instruction Fuzzy Hash: 06E1C533A0AB819AD761CF14E4407AFB7A8FB85788F144236EA9D57688DF3CD144EB40

Function 00007FF8A7D74C80 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 398COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF8A7D750A8
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s @ %p] , xrefs: 00007FF8A7D74DCB, 00007FF8A7D74E42
Last message repeated %d times, xrefs: 00007FF8A7D752F6
[%s] , xrefs: 00007FF8A7D75316
8, xrefs: 00007FF8A7D7529D
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: Last message repeated %d times$ Last message repeated %d times$%s%s%s%s$8$?$[%s @ %p] $[%s]
API String ID: 0-179686365
Opcode ID: ce54885c60954f378c52401b716c70c516f3c7c7a1fae476ce4e39e9d3599150
Instruction ID: c169a583e46653ef7a322497a85a291213f6a69c4f4b0d0908a3b44ded0003de
Opcode Fuzzy Hash: ce54885c60954f378c52401b716c70c516f3c7c7a1fae476ce4e39e9d3599150
Instruction Fuzzy Hash: 5BF11432A0A686A5FB618F11A4103BD7B91FF86BC4F844636DE9D0738ADE3DE444E741

Function 00007FF8A7D724D0 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 442COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D7262A
abort.MSVCRT ref: 00007FF8A7D726EF
memcpy.MSVCRT ref: 00007FF8A7D72A6B

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7D726DB
ret >= 0, xrefs: 00007FF8A7D726CB
src/libavutil/imgutils.c, xrefs: 00007FF8A7D726C4

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpy$abort
String ID: Assertion %s failed at %s:%d$ret >= 0$src/libavutil/imgutils.c
API String ID: 3629556515-2504023021
Opcode ID: 2312a6da2723e7e0594906141bd6e79322ef9e88a15247b0ee1471fd6e159ad7
Instruction ID: a2a869594d3d677d0c4d77e358d5ca2fa24a4c368d9abc7e254fd1c9e9f41e85
Opcode Fuzzy Hash: 2312a6da2723e7e0594906141bd6e79322ef9e88a15247b0ee1471fd6e159ad7
Instruction Fuzzy Hash: CA02D032A096C196E760CF15E4403AEB7A1FB89BD4F54423ADA9D83B98DF3DE445DB00

Function 00007FF65EE13C5C Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF65EE13C78
memset.VCRUNTIME140 ref: 00007FF65EE13C9C
RtlCaptureContext.KERNEL32 ref: 00007FF65EE13CA5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF65EE13CBF
RtlVirtualUnwind.KERNEL32 ref: 00007FF65EE13D00
memset.VCRUNTIME140 ref: 00007FF65EE13D33
IsDebuggerPresent.KERNEL32 ref: 00007FF65EE13D54
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF65EE13D75
UnhandledExceptionFilter.KERNEL32 ref: 00007FF65EE13D80

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 8e29f9cfb3282d508510f87b074f2afb23630758b427b43b81c2847ae2e7d6a0
Instruction ID: e85620c5b91d25f116f0f3c5f28a07c18dcc061880cf16755ec88019d00c034d
Opcode Fuzzy Hash: 8e29f9cfb3282d508510f87b074f2afb23630758b427b43b81c2847ae2e7d6a0
Instruction Fuzzy Hash: 23318372619B9185EF648FA0E8403ED7361FB94744F48403AEA8D97B88DF7CD688C710

Function 00007FF8BFAB6CBC Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8BFAB6CD8
memset.VCRUNTIME140 ref: 00007FF8BFAB6CFC
RtlCaptureContext.KERNEL32 ref: 00007FF8BFAB6D05
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8BFAB6D1F
RtlVirtualUnwind.KERNEL32 ref: 00007FF8BFAB6D60
memset.VCRUNTIME140 ref: 00007FF8BFAB6D93
IsDebuggerPresent.KERNEL32 ref: 00007FF8BFAB6DB4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8BFAB6DD5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8BFAB6DE0

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 13250969f5b2de30470bf22d6d750f243ba906d20c34ed2405166bb0a67cfad5
Instruction ID: 95ba3001a2a509f2eca0cc7b75fb56652af3c0992a9424e93460a7d8475f6264
Opcode Fuzzy Hash: 13250969f5b2de30470bf22d6d750f243ba906d20c34ed2405166bb0a67cfad5
Instruction Fuzzy Hash: C8316D72609E8186EB649FA8E8413ED7364FB88788F44543ADB4E47B99EF3CD548C700

Function 00007FF8A7D75980 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 408COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D759AF

Strings

cnt >= 0, xrefs: 00007FF8A7D7598F
src/libavutil/lzo.c, xrefs: 00007FF8A7D75984
[, xrefs: 00007FF8A7D759A2
?, xrefs: 00007FF8A7D75A39
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D75996

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: ?$Assertion %s failed at %s:%d$[$cnt >= 0$src/libavutil/lzo.c
API String ID: 4206212132-2884727783
Opcode ID: 7011ca950fc2a7db3eb286879491971854b83ca07a450eddb1490616219303e7
Instruction ID: d1cc4b05d3136d5888a89781c9b29788577f39647060b93599afce51174ba0fd
Opcode Fuzzy Hash: 7011ca950fc2a7db3eb286879491971854b83ca07a450eddb1490616219303e7
Instruction Fuzzy Hash: C8E11972B1F66291EB608E11818477D6A92FB447C0F99CA31CE2F07788EA7DF605E701

Function 00007FF8A7D5BE20 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 216COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D5C141

Strings

channel_layout->order == AV_CHANNEL_ORDER_CUSTOM, xrefs: 00007FF8A7D5C11D
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D5C12D
ambisonic %d, xrefs: 00007FF8A7D5BF01
src/libavutil/channel_layout.c, xrefs: 00007FF8A7D5C116

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$ambisonic %d$channel_layout->order == AV_CHANNEL_ORDER_CUSTOM$src/libavutil/channel_layout.c
API String ID: 4206212132-610793534
Opcode ID: 4154b1103f2502a80824f1cfea4b5c08add524b0e9befcb9efd5374d9646e1ef
Instruction ID: 03ce6fef4d5358cc9b83379f1e7f3daf9b6f064a1ae89fb83a03462077f99431
Opcode Fuzzy Hash: 4154b1103f2502a80824f1cfea4b5c08add524b0e9befcb9efd5374d9646e1ef
Instruction Fuzzy Hash: 2C713AA3F2A98643E7154F34D80237C5182EB957E0F4CD331E91AD6B85EE3DE9819B01

Function 00007FF8A7DD46C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7DD4707

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7DD46F3
(state[4] & 3) == 3, xrefs: 00007FF8A7DD46E3
src/libavutil/utils.c, xrefs: 00007FF8A7DD46DC
n, xrefs: 00007FF8A7DD46FA

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: (state[4] & 3) == 3$Assertion %s failed at %s:%d$n$src/libavutil/utils.c
API String ID: 4206212132-3394967418
Opcode ID: f745146a8868629358c2eef4edc24f02b811a2bcba902581bbe48fb0424e79ec
Instruction ID: 19e9b997e55f3e3b16e3eccdb11a2659f5fdc5cec4b59e03bc7f4d2c2af1a37d
Opcode Fuzzy Hash: f745146a8868629358c2eef4edc24f02b811a2bcba902581bbe48fb0424e79ec
Instruction Fuzzy Hash: 45218C6391F98271F7209E3888402BE3792EB42BE5F950332E9BEC25DACA3DD5859140

Function 00007FF8A7D5BA70 Relevance: 7.8, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

NONE, xrefs: 00007FF8A7D5BB96
%d channels (, xrefs: 00007FF8A7D5BB71
USR%d, xrefs: 00007FF8A7D5BCE0
AMBI%d, xrefs: 00007FF8A7D5BDD8
@%s, xrefs: 00007FF8A7D5BC1D
%d channels, xrefs: 00007FF8A7D5BB5E

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: %d channels$%d channels ($@%s$AMBI%d$NONE$USR%d
API String ID: 0-1306170362
Opcode ID: b58385b35ee8c0576a5674ace7b060eb4fb2608f8c8b053f2f6c87950b102242
Instruction ID: 31fd7bfa8bd7113537f0b875a9606cf4fd6843df6aa3a6591cf9f0e8c1a0490f
Opcode Fuzzy Hash: b58385b35ee8c0576a5674ace7b060eb4fb2608f8c8b053f2f6c87950b102242
Instruction Fuzzy Hash: 9F913562F1B1DA63EB648E159841A3D2641EF54BE0F88E231CD2E0778DDD3CA941E740

Function 00007FF8A7DFDAA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

pow, xrefs: 00007FF8A7DFDBCF, 00007FF8A7DFDCFE, 00007FF8A7DFE0AC

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: pow
API String ID: 0-2276729525
Opcode ID: 4e4d1c9717f4655b5bbf70594396bdc5da546f85907a2c9caf3bda01d7e980ea
Instruction ID: 83c0bd5206e53fb66742569c1f9d1b26bad89ce044b2d89f1a589c724044c34d
Opcode Fuzzy Hash: 4e4d1c9717f4655b5bbf70594396bdc5da546f85907a2c9caf3bda01d7e980ea
Instruction Fuzzy Hash: BFD1F822D0EA42B1E6225F34542427E6715EF567C8F208332E9AD362CDDFEDB491F280

Function 00007FF8A7D95B00 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D95E9A

Strings

', xrefs: 00007FF8A7D95E8D
src/libavutil/tx.c, xrefs: 00007FF8A7D95E6F
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D95E86

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: '$Assertion %s failed at %s:%d$src/libavutil/tx.c
API String ID: 4206212132-3565471776
Opcode ID: ec47289fc772912451eea82ccb2b1043ae62ca5012e7b26885c9d820250d193f
Instruction ID: 40443e12a133477309f03903d9f6fbc95989315ef4c2de693cc5bf41948f7d48
Opcode Fuzzy Hash: ec47289fc772912451eea82ccb2b1043ae62ca5012e7b26885c9d820250d193f
Instruction Fuzzy Hash: 7FA11872A0AA8196D760CF18E44036EB7A1FB897C4F545635EA5F43B98DF3DE844CB00

Function 00007FF8A7D5D5C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF8A7D5D5CD
GetProcessAffinityMask.KERNEL32 ref: 00007FF8A7D5D5E0

Strings

detected %d logical cores, xrefs: 00007FF8A7D5D6C3
overriding to %d logical cores, xrefs: 00007FF8A7D5D69D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID: detected %d logical cores$overriding to %d logical cores
API String ID: 1231390398-3421371979
Opcode ID: 2e9904b101b569c18024893eab007079966040748388d549111c530203c0def7
Instruction ID: ef61637981105a577dacfa9af6640d3400b94cbaf661f982ed21f0b63d53f1c0
Opcode Fuzzy Hash: 2e9904b101b569c18024893eab007079966040748388d549111c530203c0def7
Instruction Fuzzy Hash: A32128A3B2A84613E7144E29EC0136D1291FBA87A4F4DD236DE0EC7B59ED3CE602C341

Function 00007FF8A7D51C30 Relevance: 4.2, APIs: 3, Instructions: 497COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D51EA6
memcpy.MSVCRT ref: 00007FF8A7D51EBB

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 403baa3e1a488a5a0e7543da01e81e3aaffd6a2fe1ed6e15f3cbc0658172d83e
Instruction ID: d2ea0b308cd0a136e5a4650d2e704b11e9623e79f66576479643bd0968d0e999
Opcode Fuzzy Hash: 403baa3e1a488a5a0e7543da01e81e3aaffd6a2fe1ed6e15f3cbc0658172d83e
Instruction Fuzzy Hash: 5532F273A0DBC097E7658F29E4403AEBBA1F795384F059226DBD943A5ACB3CE164D700

Function 00007FF8A7E00640 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7E00754

Strings

__powi, xrefs: 00007FF8A7E00761

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: __powi
API String ID: 2918714741-2331859415
Opcode ID: 1ed4b1acd7149e56c63c0e5b63662fa1acdc3d18d69be49f294a8596855a1eb9
Instruction ID: b7e00cbda6afd77a07f3d4a8ca15ee44ad8abed389050c3b6ae38535784e4126
Opcode Fuzzy Hash: 1ed4b1acd7149e56c63c0e5b63662fa1acdc3d18d69be49f294a8596855a1eb9
Instruction Fuzzy Hash: 8751B234E5FA0694FA565E28585477E2354EF66FC8F188336D80E3A4C0EF1DBCA3A500

Function 00007FF8A7D53B87 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238db13e466d98e71d78f61cae172d4804caeca104bc3b3bb4d467ddbb97d8ec
Instruction ID: bef084bae350b138055503ae81ebf5e4ade9782a9c255e0a4b893c983a73abd7
Opcode Fuzzy Hash: 238db13e466d98e71d78f61cae172d4804caeca104bc3b3bb4d467ddbb97d8ec
Instruction Fuzzy Hash: 0322C262A0F7D5A6D6208E15A0403BEBBA1FB55BC0F545236DAAD53B8CCF3CE440E742

Function 00007FF8A7D5B030 Relevance: 3.1, APIs: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7D5AE10: strlen.MSVCRT ref: 00007FF8A7D5AE26
Part of subcall function 00007FF8A7D5AE10: memcmp.MSVCRT ref: 00007FF8A7D5AEA5

strtol.MSVCRT ref: 00007FF8A7D5B0F6
_errno.MSVCRT ref: 00007FF8A7D5B0FE

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errnomemcmpstrlenstrtol
String ID:
API String ID: 1078869015-0
Opcode ID: 4e62ed5a4916453a6424c7a293e756ef9a25259ab9570582f9bd8a4894d05afe
Instruction ID: 06c32d5cb908e4c3091ca3dcaca57f844584ab5033deca3582fb53f404d453e9
Opcode Fuzzy Hash: 4e62ed5a4916453a6424c7a293e756ef9a25259ab9570582f9bd8a4894d05afe
Instruction Fuzzy Hash: 9A21B2A3F2A54603EB5C8939DC2233D52C397947B0F4CD239DE1AC6789E93C99918701

Function 00007FF8A7DF9720 Relevance: 3.0, APIs: 2, Instructions: 39timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF8A7DF9739
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A7DF9760

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Time$FileInformationSystemZone
String ID:
API String ID: 2921752741-0
Opcode ID: a6735fc188ae2be04b6747e7321527e39212664d39bbfa2ed8a26b191bdbbc72
Instruction ID: 11f135a1aece7f79fea728f3de400f685867a549f0036b1e0e8a2ad2c2fa76ed
Opcode Fuzzy Hash: a6735fc188ae2be04b6747e7321527e39212664d39bbfa2ed8a26b191bdbbc72
Instruction Fuzzy Hash: A301D4B2B1964682DF68DF21F41037DA2A1EB547D4F08C231DAEE86798EE2CD945D700

Function 00007FF8A7D96350 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

%i: , xrefs: 00007FF8A7D9696A

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: %i:
API String ID: 0-3112360579
Opcode ID: 56225696255aec5cf75f5aaaa0dab9d34a63c7dc86180539428f912345232fc3
Instruction ID: e130b2eb8a21b40b74ff84e84cf61c94bc8c154708dbd186cd417530ef18fee3
Opcode Fuzzy Hash: 56225696255aec5cf75f5aaaa0dab9d34a63c7dc86180539428f912345232fc3
Instruction Fuzzy Hash: 7102E072A0AB92A6DB248F28C42067C73A0FB44BC8F554236CB7D07B98DF79E951D740

Function 00007FF8A7D95350 Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8A7D95365, 00007FF8A7D9542D, 00007FF8A7D954AB, 00007FF8A7D95522, 00007FF8A7D9559D, 00007FF8A7D9561F, 00007FF8A7D95689, 00007FF8A7D956D4

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID: 0-399585960
Opcode ID: 32d18d1ae2b9536030ec3fb165465a0a39662cd1298dc4829aec3954e2195451
Instruction ID: 9da75725c9a31fde72e50a7ef8a84e3f5d27f7d17b28f7285e21ff1f33d67b8f
Opcode Fuzzy Hash: 32d18d1ae2b9536030ec3fb165465a0a39662cd1298dc4829aec3954e2195451
Instruction Fuzzy Hash: 42E19E32A09A8697E7209F16E040BAE7760FB84BC4F514536DF9E43B99DF39E502DB00

Function 00007FF8A7DD4840 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 00007FF8A7DD4840

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: 0123456789abcdef
API String ID: 0-1757737011
Opcode ID: 067b04213758aebbec89ab64825b0ea9af463173314dc67680d0fe0a86fcad37
Instruction ID: 3d499239d5603da63e6844bb4fb43047674f78cc5a196cd14946289c185271ee
Opcode Fuzzy Hash: 067b04213758aebbec89ab64825b0ea9af463173314dc67680d0fe0a86fcad37
Instruction Fuzzy Hash: 4B61C8977292F19ED72247A9A810F9CBE52D266B45F1D4289D7C10BF93C212C0B2FB21

Function 00007FF8A7D5B150 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

%d channels, xrefs: 00007FF8A7D5B273

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: %d channels
API String ID: 0-1351059727
Opcode ID: fb37549d1e1a87d1845128c91bcf027e9804e02a172115fddd54d2ad187c1367
Instruction ID: d2b5f4f488aa03342cf55f2f6e78516c5c21b42bcf4b1c3ba16071e33f709a20
Opcode Fuzzy Hash: fb37549d1e1a87d1845128c91bcf027e9804e02a172115fddd54d2ad187c1367
Instruction Fuzzy Hash: AE4119A3F0B88A22EB558E05BC0167D4242EBA5BF5F8CE132DD1947B48ED3C9986D301

Function 00007FF8A7D92B60 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

%02u:%02u:%02u%c%02u, xrefs: 00007FF8A7D92C47

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: %02u:%02u:%02u%c%02u
API String ID: 0-3773705257
Opcode ID: 05e44b18eb7a4dcf895f83e0c2975131c3305643ef67c3862a7710349e35a628
Instruction ID: 43b7e5b870580dd3b36abc754322a478944ce047edb5a7445887451c153d63c9
Opcode Fuzzy Hash: 05e44b18eb7a4dcf895f83e0c2975131c3305643ef67c3862a7710349e35a628
Instruction Fuzzy Hash: 55316EB3F2A9556AEB65CE159C4076E2242F7447C9F888330ED1A4BB4CEA3CF948D340

Function 00007FF8A7D5E9A0 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

9%lld, xrefs: 00007FF8A7D5EADF

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 4bf4b89b430cf95bf7994c152801e5258dcff788620b942f10691eac737950a8
Instruction ID: ed96ed3921cbda4188cc32473884c75439e44e96ea112891c65d691fe2142cff
Opcode Fuzzy Hash: 4bf4b89b430cf95bf7994c152801e5258dcff788620b942f10691eac737950a8
Instruction Fuzzy Hash: 2231D4A373594053E697DE66A8552ED2752F3497CAF84B031FE0B8B348E67DDD05E100

Function 00007FF8A7D5E820 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

9%lld, xrefs: 00007FF8A7D5E95C

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: b7dcea320b78e429be7da6e3a51ac97eece9d04196250d78cf97526035406e98
Instruction ID: 50f0eff986847ad27e8d360f7cd13e8e47102f6ac8c5b1d469446281d8f2f410
Opcode Fuzzy Hash: b7dcea320b78e429be7da6e3a51ac97eece9d04196250d78cf97526035406e98
Instruction Fuzzy Hash: 8631E66373199153E682DEA6A4516EC2751F38D7CAFC46132FE0AC7308EA78CD09E200

Function 00007FF8A7D92CC0 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

%02u:%02u:%02u%c%02u, xrefs: 00007FF8A7D92D5D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: %02u:%02u:%02u%c%02u
API String ID: 0-3773705257
Opcode ID: fdd9d13a151395552cd65e209512f394c3a647e9cf21eb926f75bca4cb5d8e29
Instruction ID: ea7c74c2232787e23e19fc237259ec047e82f5b8fbc523ec50b299910801517e
Opcode Fuzzy Hash: fdd9d13a151395552cd65e209512f394c3a647e9cf21eb926f75bca4cb5d8e29
Instruction Fuzzy Hash: FE116A7353844446DB49DF1A88106AD7290F390BC4BC84235E95BCF748DE3CE709D704

Function 00007FF8A7D5B6A0 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

front left, xrefs: 00007FF8A7D5B743

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: front left
API String ID: 0-959785498
Opcode ID: 23cad181ecbb07febb14ec29e22a05d1089456614179c0b502e2ad97e0cb5eae
Instruction ID: 9910e460b2a431a6c2066b8bf6dc9aae8d5fb8bd48568e3af4fc900220aeec04
Opcode Fuzzy Hash: 23cad181ecbb07febb14ec29e22a05d1089456614179c0b502e2ad97e0cb5eae
Instruction Fuzzy Hash: 7511CAD7F3659A43EF604A6DCC0275802C2D3A57B074CE231E859C6B49FC3DE6529642

Function 00007FF8A7D787F0 Relevance: 1.3, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF8A7D78819

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 30d0097c098d0a2c9e6ec4e870c0f712385f61fe009233d20c93c0c5dbd3fad9
Instruction ID: a054c8d83336187ec6ba6e55cb659c39e13b16403d55bc8a806fd3f1567b037e
Opcode Fuzzy Hash: 30d0097c098d0a2c9e6ec4e870c0f712385f61fe009233d20c93c0c5dbd3fad9
Instruction Fuzzy Hash: 5411B2A2751B4C53AD08C7AAA8B68B9925AA3ADFD4718F032CE0D4B354DD3CE092C340

Function 00007FF8A7D84920 Relevance: 1.0, Instructions: 994COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e651fe4c88c82812c6238caf3bdcde6ab459b46390ea8f8b4a9699f07545262f
Instruction ID: 1bda1fb4674d5b31257bf7ffee1b08a0ed086879fa134946f1178f46d8c42b44
Opcode Fuzzy Hash: e651fe4c88c82812c6238caf3bdcde6ab459b46390ea8f8b4a9699f07545262f
Instruction Fuzzy Hash: 6572EAB7B251204BE354CF2AE844E46BB92F7D8748B56A114EE56E7F04D23DEA06CF40

Function 00007FF8A7D83C00 Relevance: 1.0, Instructions: 989COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d4f91dbcd3920678f56ce2ea7d672d73a39a89e5afe551f032633b1d0d58bd
Instruction ID: 964c822f9f187339aa42b2d0479b64a4cd5d221fa53f8ffe4ad9e35da9718a6b
Opcode Fuzzy Hash: f1d4f91dbcd3920678f56ce2ea7d672d73a39a89e5afe551f032633b1d0d58bd
Instruction Fuzzy Hash: A0720977B282244B9318CF26E809D4AB796F7D4704B469128EF16D7F08E67DEA058F84

Function 00007FF8A7D73580 Relevance: .7, Instructions: 727COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a118a507555301ea384540139cf8e1fb3b65300ff54bfeb7e4b20e0f2e86e279
Instruction ID: 4a26795e8fd587acb0dee775d063cee7e80a4bbd879a2b5e48fac3114f320ddc
Opcode Fuzzy Hash: a118a507555301ea384540139cf8e1fb3b65300ff54bfeb7e4b20e0f2e86e279
Instruction Fuzzy Hash: DF52176361D2E187E3648F69A400B7EF6E1FBD4781F10A225EAD993B98E73CD540DB10

Function 00007FF8A7D76820 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36dddfe8cf3ff9be88c3b72cff50abe549f3a298be1906c93472ea6cf2cfdb2f
Instruction ID: db5489a259d735a862c19cc01f8f159e13eb80069366eb804d258b2fd0a75bd5
Opcode Fuzzy Hash: 36dddfe8cf3ff9be88c3b72cff50abe549f3a298be1906c93472ea6cf2cfdb2f
Instruction Fuzzy Hash: 4F12B377B6016047D76CCF36E816F993796E399758389E12C9A02D7F08DA3DD90ACB80

Function 00007FF8A7D93560 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8160ea691a23e1b632a407eca822979379531e44aeec8686b9d2442b5e3ae57d
Instruction ID: 3ce4356e1aa423a5e481f54ee0d8e92a0e1c0cd78afef7eac3db6a4ad8dad467
Opcode Fuzzy Hash: 8160ea691a23e1b632a407eca822979379531e44aeec8686b9d2442b5e3ae57d
Instruction Fuzzy Hash: 59229172B2AF4592DA60DF16E444A2E6769FB84FC4B558235DF6E9BB48DF38D400E300

Function 00007FF8A7D9CBE0 Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff40ba625cf61736bb64c8bdf5840a366f4253e3d55665abfb5f43b414cbf64c
Instruction ID: caaa6ff81cdddfe693f1aae14aa938755ba628adbc9b0deab8f6d9d76b5930e5
Opcode Fuzzy Hash: ff40ba625cf61736bb64c8bdf5840a366f4253e3d55665abfb5f43b414cbf64c
Instruction Fuzzy Hash: 7422C462E29F904ED253CE75945223E6B58FFAA7C4B41D313EE5B76B12DB34E1878200

Function 00007FF8A7D809B0 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0debf0142da6a9273804bc82d00e17f960341957d4bf9a7368440b236c8168
Instruction ID: 9b76c943aab5b676243b2cd259dce3da6911b32d3a9b23c6af6bc255ac81cf7a
Opcode Fuzzy Hash: 5d0debf0142da6a9273804bc82d00e17f960341957d4bf9a7368440b236c8168
Instruction Fuzzy Hash: 93020373F1A691A6FB754F10E101E7C7FA0FB50B85F45923AC76E17B88DA38A915A300

Function 00007FF8A7DB2B80 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5050afa32f6ddfb6a114996f9f218715255f7c7b544984919c9caa6235c0bb16
Instruction ID: ce9a441d17a950cd35e1922249928e291d9bf06999e76e4b96ccd20dbee61707
Opcode Fuzzy Hash: 5050afa32f6ddfb6a114996f9f218715255f7c7b544984919c9caa6235c0bb16
Instruction Fuzzy Hash: FB220532E29A8C57C612CE77948117D7B20FBAE7C4B59DB16EE05726A2DB34F0849700

Function 00007FF8A7D57260 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a7950f2253a1c48c8c137fbc100e25f2fe9e5a0653b74c0b8ed70f9fb77fc6
Instruction ID: 4972b1dd6833cd9337ab7e9be222d1640362417749ca48f8584a8a86915778ae
Opcode Fuzzy Hash: 81a7950f2253a1c48c8c137fbc100e25f2fe9e5a0653b74c0b8ed70f9fb77fc6
Instruction Fuzzy Hash: 0E1284732108148BD391CF5EE8C0E5DB7D1F798B4EB629324EB4693B61D632A863D790

Function 00007FF8A7D81160 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7b787218cfe6dc98328e18f40f484bb36194aafcb0adaf6dc1dee95f7ee729
Instruction ID: 034750beaf22d256c6442ea54c7db6be4a259d13e5b38267ffa4ae35f888ba3a
Opcode Fuzzy Hash: 6f7b787218cfe6dc98328e18f40f484bb36194aafcb0adaf6dc1dee95f7ee729
Instruction Fuzzy Hash: 08B106B3F1668096EB704F54E002F7D7BB0FF50B84F45927DCB1A57B84E6296519A380

Function 00007FF8A7D59D50 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b431d04f8cfd326d065826c0ea4a07768d4831b2dc7686569c959b8d95ae5da
Instruction ID: 66a9cdfb3ee6b28060d8278634c7ce4afe095ae3da8e23f2dd1dd8d70d7782e2
Opcode Fuzzy Hash: 1b431d04f8cfd326d065826c0ea4a07768d4831b2dc7686569c959b8d95ae5da
Instruction Fuzzy Hash: FBB1C15260A5C16AEB198F769910AEF6BA0EB5DBC4F44F122DFDD4B74ACE28D241D300

Function 00007FF8A7D5A520 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd04e1f6e5b77fd235431d6daf680498f867f8c369b5541b7e47b1bcb3da3638
Instruction ID: 27cab42b70a46c01e054adac927cce4fccd8248fb1e0c49a6298cf32200a2dcb
Opcode Fuzzy Hash: bd04e1f6e5b77fd235431d6daf680498f867f8c369b5541b7e47b1bcb3da3638
Instruction Fuzzy Hash: 95B1BC735006588FD348DF6AD95843E7BA2F7D8B59B9B0229DB4317380EB706826DB90

Function 00007FF8A7D5A1B0 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26bc9e0afa6a36dad590029bfac38e6475024b67d277dcd255fc33b8d7af121
Instruction ID: fcaca9ce64cb4d151a134b680d44fd9c03959f9d0bbc5aee5cb66ef673e786cd
Opcode Fuzzy Hash: c26bc9e0afa6a36dad590029bfac38e6475024b67d277dcd255fc33b8d7af121
Instruction Fuzzy Hash: 6AB16E33A001A48FD788CF6ED89887D37A3E7C871179B832ADB4553389DA746819DBC0

Function 00007FF8A7D72F20 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f169184c6d2b13734529f87c174bec29b0316c2a188a1d7a05902af3d816c2
Instruction ID: d79924a71646e02d241fe9ddc312112257f7b1a94f2eaec089d8029a109d3be2
Opcode Fuzzy Hash: 99f169184c6d2b13734529f87c174bec29b0316c2a188a1d7a05902af3d816c2
Instruction Fuzzy Hash: 36918C91B3E1A2A3F7798E4D840173EA595FF10BC0F40A235ED5E67B88DA2EE550D700

Function 00007FF8A7D56E70 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a701fd31c154d2dc192229eb25d8d25638208f0de1ecaa09b169f4e8a8f8eb
Instruction ID: 5ecff00a341bd34dbe8412c3541c4df4444f7e048cbc0b7a87d7250357c9fd73
Opcode Fuzzy Hash: c8a701fd31c154d2dc192229eb25d8d25638208f0de1ecaa09b169f4e8a8f8eb
Instruction Fuzzy Hash: 45A130720198148BE34BCF5E948021EB3E1FB48A9FB616710EF4F87661D636AE63D750

Function 00007FF8A7D944D0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b32cb7f7fc63c6fb00127071f37436bbba4780064a9dd077ecd279716693df
Instruction ID: 2f7d40e72870da43b8136103e1533accb0bd59183e78ea78eefd1213d7a6048a
Opcode Fuzzy Hash: 90b32cb7f7fc63c6fb00127071f37436bbba4780064a9dd077ecd279716693df
Instruction Fuzzy Hash: 9A91C3231092E0AED306CF3A96449AE7FE0F71E788B99D151DB954BB47C338E612D750

Function 00007FF8A7D59A50 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ca8846758f7279c89c706cb55d4a6c794990205b94bc84ef3eb9dab7f83264
Instruction ID: b00eafbf808867b5ca5a722ba1467998c39353de8e02f81ccbdd3e16573ec5cc
Opcode Fuzzy Hash: 76ca8846758f7279c89c706cb55d4a6c794990205b94bc84ef3eb9dab7f83264
Instruction Fuzzy Hash: 0C618DA27064A457EE98DF368D612AE1395BB4CBC1F81F832DD4D87389DE38D842C741

Function 00007FF8A7D830A0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01a8d336d240b66a520b8f76eca36f64ac119a91bb538f3d36a02399c46787c
Instruction ID: e4da04b6f1c1405c8b720a9a249309b78209aca115888c2a93f4cb60b34286b1
Opcode Fuzzy Hash: a01a8d336d240b66a520b8f76eca36f64ac119a91bb538f3d36a02399c46787c
Instruction Fuzzy Hash: F9510A22B1F7E555EA348E2A7900BAEA6C9FB58FC4F4991359D0D5BF84EA3CE4425300

Function 00007FF8A7D5E4C0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d77631254022a2564090f98b8bfa30d20299f2ed0b727a65807a914737ba4ae
Instruction ID: ef270208bf083759fe775fe54e4ad04e35967ca5cd3e5631789d421dab90c000
Opcode Fuzzy Hash: 5d77631254022a2564090f98b8bfa30d20299f2ed0b727a65807a914737ba4ae
Instruction Fuzzy Hash: 50419766F0654213FF19ED7AEC5502E5286BBC87D47046239EE2F8BB8DED78E481D240

Function 00007FF8A7D91E10 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afccfe9f3e014e08196aad724a937f91ef825408217a78f00344b29ce58b4f81
Instruction ID: ba873a4754f721b7da333c582952175187784af25b3fbc66f965cf64dbf0328d
Opcode Fuzzy Hash: afccfe9f3e014e08196aad724a937f91ef825408217a78f00344b29ce58b4f81
Instruction Fuzzy Hash: 64511533B0A6C06AD71A8F31A9046ADBFE0F719788B488139DF9D43B49C63CE551D710

Function 00007FF8A7D5D210 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925e7221762b452499bd5f1cd8d4647ae936fd8bfb8d6f0e8219c8ca6ea31777
Instruction ID: c997f7ff852280191f447f3a4eae77f41268ff200e7d3e8103b652bf3f3ddd39
Opcode Fuzzy Hash: 925e7221762b452499bd5f1cd8d4647ae936fd8bfb8d6f0e8219c8ca6ea31777
Instruction Fuzzy Hash: 82412473F1B48657F7684D29D881B3D1680EB64BECB08A235ED2AC77C8D82CE9819351

Function 00007FF8A7D82B40 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da0fa7538a61e1ec26d81ef3ee2e77181907d7570b22cc55868e0e260c2f721
Instruction ID: f47a9af7519f3c5146d2280ee710eef5902eb86a8e0100cbf84bb395b0200cdb
Opcode Fuzzy Hash: 1da0fa7538a61e1ec26d81ef3ee2e77181907d7570b22cc55868e0e260c2f721
Instruction Fuzzy Hash: F9414602F1A2E10BC7924EFF4DD922DADD2158E44638CC77AA7D4C52DFD86CE20E6614

Function 00007FF8A7D5CCE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbb289327d116bb0d3926814ce134dcf89bf85936bb88c31896ce7583001f71
Instruction ID: 46e00b9eafc158b1b63296de119c750ea843388c567c891be879d6552ee5718b
Opcode Fuzzy Hash: 1bbb289327d116bb0d3926814ce134dcf89bf85936bb88c31896ce7583001f71
Instruction Fuzzy Hash: 7241A4E3F3A84603DB6D8629CC057285183A7E57B175CE235D92ED6FCCE83CDA159502

Function 00007FF8A7D828B0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8289133b11807aa708dee106fcce6d7ef6ccc2dac79a51c200281d0fae8d85f5
Instruction ID: 0a24dedc9a0a57ffe617537608a8400275a41b98e14bb4ea312f375e18c72059
Opcode Fuzzy Hash: 8289133b11807aa708dee106fcce6d7ef6ccc2dac79a51c200281d0fae8d85f5
Instruction Fuzzy Hash: 8741A2522380F00AC76E1F3D293AA39BE92725664774EE36EFE8342AC7D41D8910A714

Function 00007FF8A7D513A0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e751435a9f45e6580fe7b108adce3f96b0c8069535fb2d3307a909beff15caba
Instruction ID: 1b465f0f8aef780524d189f0c20a77e8d58fa526eba53b4613253a1a1bf12749
Opcode Fuzzy Hash: e751435a9f45e6580fe7b108adce3f96b0c8069535fb2d3307a909beff15caba
Instruction Fuzzy Hash: FB318A93F622AB13FF198F596C01BB89441AF447D8F44A235ED2E5BBC9E43DD946E200

Function 00007FF8A7D5D030 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cb80125cf637f8d0b0a114fc56422192b4e9792f88120ada6a7116402668c2
Instruction ID: 91e1f7b7f43fa15b6faa4d3e4638223654d2558f253c804f0ea386f19a15174c
Opcode Fuzzy Hash: 66cb80125cf637f8d0b0a114fc56422192b4e9792f88120ada6a7116402668c2
Instruction Fuzzy Hash: 1B31A0E7B364B943EB7C0639C855F280181D7657B4B8CE139DD1AC2F80E81EE6418F52

Function 00007FF8A7D51990 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50bf9d45b07f9fed7a8078693abee7f23351cad672a747608ffeb063cebe12d
Instruction ID: de43a97df98475cc3a909f1b5038e294f9a74bc440bfd1b00bf7be7a697fbe09
Opcode Fuzzy Hash: f50bf9d45b07f9fed7a8078693abee7f23351cad672a747608ffeb063cebe12d
Instruction Fuzzy Hash: 96515E33509AE18AD792DB64D448BED3BA8F71D388FA64471CBAD83702DBB5D990D700

Function 00007FF8A7D51730 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860bab9d395cf43ed3b1cf56782110bfed2c0c3dddb8109515e6473b81413bd7
Instruction ID: a5f7834a4676d7b53773c2cb6bf43bca7a35c965d06e00c94bd2c027d15d5167
Opcode Fuzzy Hash: 860bab9d395cf43ed3b1cf56782110bfed2c0c3dddb8109515e6473b81413bd7
Instruction Fuzzy Hash: 58519E73109AE186E792DB64D448BEE3BA4F719384FA68571CBEC83702DBB5C890C700

Function 00007FF8A7D733E0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf754ad211c098a8f34c6fa0d70b3b75da22e1392d81fac143d3245663dd1af9
Instruction ID: 9492821b6de2a70161d2300d422c6ae39868de26929bedbb96f0026dc36eff24
Opcode Fuzzy Hash: bf754ad211c098a8f34c6fa0d70b3b75da22e1392d81fac143d3245663dd1af9
Instruction Fuzzy Hash: 2C41B4A673C0F263F3354B18E002E2EF7A1EB52FC5B546310DBA422E58D66AD558EF10

Function 00007FF8A7D94330 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b6c65e6f8fbbfa1a7d368a2725116908e408c53695cc2cda4a45b28fc02054
Instruction ID: 0af5007090373f5916cb96a79c9dd56dd7f7daea4f31fd02fd82f195c5f6ff10
Opcode Fuzzy Hash: 51b6c65e6f8fbbfa1a7d368a2725116908e408c53695cc2cda4a45b28fc02054
Instruction Fuzzy Hash: 88417E731046648BD301CF2AE981A9AB7E2F398B4CFA5D225DF4257356D739A907CB80

Function 00007FF8A7D5B460 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b83fdb0131200dfce48832797b5ce1ee65e01df28847898595a6ba08a50e8d6
Instruction ID: 4a4d85f755a89dd5500a4242924a5abcd7abb3e05055d26e331ea4249f7cc796
Opcode Fuzzy Hash: 1b83fdb0131200dfce48832797b5ce1ee65e01df28847898595a6ba08a50e8d6
Instruction Fuzzy Hash: D0217FE7F3186A03EB78423DEC16F1404C251B977434CE135E916C6F85F42EEA424A83

Function 00007FF8A7D72D20 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9accf3f83477c77ce7ab5b6679156a875be267288f965f0b915796913070d0d7
Instruction ID: 7eed5754b1834e89ad7b281dee9995115732208a055216060500222a49c2bc36
Opcode Fuzzy Hash: 9accf3f83477c77ce7ab5b6679156a875be267288f965f0b915796913070d0d7
Instruction Fuzzy Hash: 1121299B7315F903FB010ABE6D056759982A188BF73499732ECA8E77CDC478DC519290

Function 00007FF8A7D72BF0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a414ea0c491aecb8e1acee4f50acb857c601688e8d49eddf1fb7be55f6bcb7eb
Instruction ID: 7a5d0e89ee220409aea0cd3b8462f96d225d0e593cd00c887ba69c6791ff7a16
Opcode Fuzzy Hash: a414ea0c491aecb8e1acee4f50acb857c601688e8d49eddf1fb7be55f6bcb7eb
Instruction Fuzzy Hash: 7F213E9FF656BA03FB1846AF6C412786280E648BF63489732DDDDE77CAD47C890291D0

Function 00007FF8A7D5C1A0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f149c23a356f76f238516a0c29d6d6da4b78dcaf03ebe63ea6bb4be2698659
Instruction ID: cf7048e9f5a91fb3f0db852140eadc0e1a8b1777aaa0120cfe479e01e0342cce
Opcode Fuzzy Hash: 13f149c23a356f76f238516a0c29d6d6da4b78dcaf03ebe63ea6bb4be2698659
Instruction Fuzzy Hash: 152197FBF3A0E653DB754B6DD500F282941A361BF4698F134C91E83E84E916D641EF02

Function 00007FF8A7D5D700 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e375ad6e9128b21d2b8073199f54bc1e05150e57f45dacb5095166fe167bd8
Instruction ID: 82092c33702a046718b8fdbeb0818a1abccd445aafa638c22f056e74509d14ac
Opcode Fuzzy Hash: b6e375ad6e9128b21d2b8073199f54bc1e05150e57f45dacb5095166fe167bd8
Instruction Fuzzy Hash: 1F216673B708EA07D7508779E846F946A90E3A1B4CF98E631E725D3E80D13EE092C740

Function 00007FF8A7D5D8D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333bc48ed0cd00a2d1b15b774f25581d7625ddc281499ec81eb7566562b50259
Instruction ID: bf58ea62bdeea5a3c1e28ef6ad64e244a25949ec396abc3ecb626000a4bf6a79
Opcode Fuzzy Hash: 333bc48ed0cd00a2d1b15b774f25581d7625ddc281499ec81eb7566562b50259
Instruction Fuzzy Hash: E51160B3B324B20BD7489AB8CC063A932C3D3C8746F9CC534E755CAA89D53CE2519604

Function 00007FF8A7D5B790 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921da5e6bee8a79c60022e540b3013bc24987b6f10c9384b169f9994f4f13c7f
Instruction ID: fcb4ffdad874078331f276a2f255bd002654dc4e6c2deed0333fc39fee4ab596
Opcode Fuzzy Hash: 921da5e6bee8a79c60022e540b3013bc24987b6f10c9384b169f9994f4f13c7f
Instruction Fuzzy Hash: 46115EF7F360AA03EB7C055AE822F7809419375BA898CF13DDE1B12F81E81E56405B42

Function 00007FF8A7D5B5C0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c7e682ef6fe0021f165804b69b7812e3084bd1803e36f36abadd25f99cf90a
Instruction ID: 08dd8caaf8fade23febe0e2ba36b9dc3dab9647f4b81b1857dc8b1110168b319
Opcode Fuzzy Hash: 48c7e682ef6fe0021f165804b69b7812e3084bd1803e36f36abadd25f99cf90a
Instruction Fuzzy Hash: 5911A5D7F379AA03EB60493DCC427180182D7A57B178CE632EC19CAF49E83DE6519A42

Function 00007FF8A7D5DEF0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8c63fbc3d1884eef626a7aef42dd066a5768f9b76b144cbd0180c709170efd
Instruction ID: 9ba0978b847245e524e66be69e8f98e32f980fdc44fdb1f9c7caa73938d69153
Opcode Fuzzy Hash: 5b8c63fbc3d1884eef626a7aef42dd066a5768f9b76b144cbd0180c709170efd
Instruction Fuzzy Hash: D4112972A070D15BEA95CF29D498ABC33D1E784388FC59236DB158768CD73CE941E760

Function 00007FF8A7D5B8D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87362e0b0484954b111388de62736d52838e743fda6cb01bb5a4730a87f793d9
Instruction ID: e0c60cfb44f26627243deb9d7f859b8837e238aaeb6784e604fd187a9cf79d19
Opcode Fuzzy Hash: 87362e0b0484954b111388de62736d52838e743fda6cb01bb5a4730a87f793d9
Instruction Fuzzy Hash: ED017CE3F328A903DB64867DCC0670400C396F877178CE131B914C6F89F83EE6418A42

Function 00007FF8A7D5B380 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b36b57bc46747f380974be252968c61105f93df6c2abcd15431a709e92770c1
Instruction ID: 14bd2cacf1174b1c4f3da44626b05ac20a3ec18444f4115fae820648a13c1207
Opcode Fuzzy Hash: 7b36b57bc46747f380974be252968c61105f93df6c2abcd15431a709e92770c1
Instruction Fuzzy Hash: 43F0B7D7F3685A03EB5C456DDC1631401C391E823238DD13ABA47C6B8AF839EA968643

Function 00007FF8A7D599C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dde2236b060dd472fafee045e56aa39d7b712360777964fc0ed02c3a9815e90
Instruction ID: a6d6364920ed2d541e5cd8914c60f6f20c110aefc493042eb7db3851c6d05d0c
Opcode Fuzzy Hash: 3dde2236b060dd472fafee045e56aa39d7b712360777964fc0ed02c3a9815e90
Instruction Fuzzy Hash: 92F0AFD9231BB64BE911A69990D07D69721F30DBC6B70A622DE4D27335CA17A10BCA00

Function 00007FF65EE13E04 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9511fbd7afa4ad21328c4c2650442df0d5d07feab4356b821a062b44ea0b29a4
Instruction ID: 7876544f4ecf0b60c8542d4784aa446bb2815bd5508bce6a792e89e6ac78254b
Opcode Fuzzy Hash: 9511fbd7afa4ad21328c4c2650442df0d5d07feab4356b821a062b44ea0b29a4
Instruction Fuzzy Hash: 37A0016192CA2290EA088BC0AA601256330AB70300B8A0075E04DA11659EACA9958652

Function 00007FF65EE125C0 Relevance: 51.0, APIs: 6, Strings: 23, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65EE12570: printf.MSPDB140-MSVCRT ref: 00007FF65EE12587

Part of subcall function 00007FF65EE12530: atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,00000000,00007FF65EE12617,?,?,?,00007FF65EE11BD6,?,?,?,00007FF65EE11A02), ref: 00007FF65EE12552

puts.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF65EE11BD6,?,?,?,00007FF65EE11A02), ref: 00007FF65EE128DF

Strings

video height, xrefs: 00007FF65EE126D7
video colorspace, xrefs: 00007FF65EE12731
Must have at least 1 audio track or 1 video track, xrefs: 00007FF65EE1266A
file name, xrefs: 00007FF65EE125E1
video max luminance, xrefs: 00007FF65EE1278B
muxer settings, xrefs: 00007FF65EE128BA
video width, xrefs: 00007FF65EE126B9
audio codec, xrefs: 00007FF65EE12809
video bitrate, xrefs: 00007FF65EE1269B
{stream_key}, xrefs: 00007FF65EE12897
video color trc, xrefs: 00007FF65EE12713
video codec, xrefs: 00007FF65EE1267D
video codec tag, xrefs: 00007FF65EE127DE
video color range, xrefs: 00007FF65EE1274F
video fps num, xrefs: 00007FF65EE127A9
video chroma sample location, xrefs: 00007FF65EE1276D
audio track count, xrefs: 00007FF65EE1261F
Invalid number of audio tracks, xrefs: 00007FF65EE12652
Invalid number of video tracks, xrefs: 00007FF65EE128D8
video fps den, xrefs: 00007FF65EE127C7
video track count, xrefs: 00007FF65EE12601
stream key, xrefs: 00007FF65EE12872
video color primaries, xrefs: 00007FF65EE126F5

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: atoiprintfputs
String ID: Invalid number of audio tracks$Invalid number of video tracks$Must have at least 1 audio track or 1 video track$audio codec$audio track count$file name$muxer settings$stream key$video bitrate$video chroma sample location$video codec$video codec tag$video color primaries$video color range$video color trc$video colorspace$video fps den$video fps num$video height$video max luminance$video track count$video width${stream_key}
API String ID: 3402752964-4246942696
Opcode ID: bbb72588bee9787a683502761444138c14bf0f1375247d53f9cdc5c5b4da8170
Instruction ID: 7ec37c3f61f153e3d3be1307ffd138af240f1ecff68bf87476cea40271660274
Opcode Fuzzy Hash: bbb72588bee9787a683502761444138c14bf0f1375247d53f9cdc5c5b4da8170
Instruction Fuzzy Hash: 27818F64928A6291FE1CDBD1BB545F82351AF2D7C0F895032FD4DA7285AFBCE18AD300

Function 00007FF65EE11C50 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE11C70
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE11C8E
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE11C9E

Part of subcall function 00007FF65EE12320: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FF65EE129D8,?,?,?,00007FF65EE112F1), ref: 00007FF65EE12357

os_event_wait.OBS ref: 00007FF65EE11CEF
pthread_mutex_lock.W32-PTHREADS ref: 00007FF65EE11D0F
memcpy.VCRUNTIME140 ref: 00007FF65EE11D5D
memcpy.VCRUNTIME140 ref: 00007FF65EE11D76
memcpy.VCRUNTIME140 ref: 00007FF65EE11E2D
memcpy.VCRUNTIME140 ref: 00007FF65EE11E48
os_event_signal.OBS ref: 00007FF65EE11EB8
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE1200F

Strings

Error writing to '%s', %s, xrefs: 00007FF65EE11FC3
Error allocating memory for output, xrefs: 00007FF65EE11C97

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpy$__acrt_iob_func__stdio_common_vfprintffclosefprintfmallocos_event_signalos_event_waitpthread_mutex_lock
String ID: Error allocating memory for output$Error writing to '%s', %s
API String ID: 2637689336-4070097938
Opcode ID: a31c7b85b8c0d82d0157cb35a6e72543ed071c06804e902690462ed57beb3fc0
Instruction ID: 77d85e9b47b3a92f40a7d86b1866cd5a9c05482480975952bf5fc5116facc697
Opcode Fuzzy Hash: a31c7b85b8c0d82d0157cb35a6e72543ed071c06804e902690462ed57beb3fc0
Instruction Fuzzy Hash: F3A18132A28B9285DB15DFA1E6003FD6361FB68B88F480035EE8DA7759DFB8D585C310

Function 00007FF8A7D60410 Relevance: 36.1, APIs: 24, Instructions: 131COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D6043E
_aligned_free.MSVCRT ref: 00007FF8A7D60475
_aligned_free.MSVCRT ref: 00007FF8A7D604AD
_aligned_free.MSVCRT ref: 00007FF8A7D604DD
_aligned_free.MSVCRT ref: 00007FF8A7D6050D
_aligned_free.MSVCRT ref: 00007FF8A7D60528
_aligned_free.MSVCRT ref: 00007FF8A7D60531
_aligned_free.MSVCRT ref: 00007FF8A7D6053A
_aligned_free.MSVCRT ref: 00007FF8A7D60542
_aligned_free.MSVCRT ref: 00007FF8A7D6054A
_aligned_free.MSVCRT ref: 00007FF8A7D60553
_aligned_free.MSVCRT ref: 00007FF8A7D6055C
_aligned_free.MSVCRT ref: 00007FF8A7D60564
_aligned_free.MSVCRT ref: 00007FF8A7D6056C
_aligned_free.MSVCRT ref: 00007FF8A7D60575
_aligned_free.MSVCRT ref: 00007FF8A7D6057E
_aligned_free.MSVCRT ref: 00007FF8A7D60586
_aligned_free.MSVCRT ref: 00007FF8A7D6058F
_aligned_free.MSVCRT ref: 00007FF8A7D60598
_aligned_free.MSVCRT ref: 00007FF8A7D605A1
_aligned_free.MSVCRT ref: 00007FF8A7D605A9
_aligned_free.MSVCRT ref: 00007FF8A7D605B2
_aligned_free.MSVCRT ref: 00007FF8A7D605BC
_aligned_free.MSVCRT ref: 00007FF8A7D605C6

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: b1b7e4f8b11abefead583c2dde418006ab1f199e84be47299285f48100eacfdc
Instruction ID: 113f56245a2420ac218a3722ea0a57201ecef0604e937b687a5231beda99f334
Opcode Fuzzy Hash: b1b7e4f8b11abefead583c2dde418006ab1f199e84be47299285f48100eacfdc
Instruction Fuzzy Hash: F2514526B2650163DA50EF12D895A7E2329FF84FD5F014A76DE6D4B399CE38F401E380

Function 00007FF8A7D88800 Relevance: 34.6, APIs: 12, Strings: 11, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D88813
strcmp.MSVCRT ref: 00007FF8A7D8882A
strcmp.MSVCRT ref: 00007FF8A7D88841
strcmp.MSVCRT ref: 00007FF8A7D88858
strcmp.MSVCRT ref: 00007FF8A7D8886F
strcmp.MSVCRT ref: 00007FF8A7D88886
strcmp.MSVCRT ref: 00007FF8A7D8889D
strcmp.MSVCRT ref: 00007FF8A7D888B4
strcmp.MSVCRT ref: 00007FF8A7D888CB
strcmp.MSVCRT ref: 00007FF8A7D888DE
strcmp.MSVCRT ref: 00007FF8A7D888F1
strcmp.MSVCRT ref: 00007FF8A7D88904

Strings

dbl, xrefs: 00007FF8A7D88868
s64, xrefs: 00007FF8A7D888EA
s16, xrefs: 00007FF8A7D88823
s32p, xrefs: 00007FF8A7D888AD
s16p, xrefs: 00007FF8A7D88896
flt, xrefs: 00007FF8A7D88851
dblp, xrefs: 00007FF8A7D888D7
s32, xrefs: 00007FF8A7D8883A
s64p, xrefs: 00007FF8A7D888FD
u8p, xrefs: 00007FF8A7D8887F
fltp, xrefs: 00007FF8A7D888C4

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: dbl$dblp$flt$fltp$s16$s16p$s32$s32p$s64$s64p$u8p
API String ID: 1004003707-1774405992
Opcode ID: c5f0c382e97445bf1fdad9ea523356781cb8596a76fcd8cb5a790a5f3faa4372
Instruction ID: 0c9923773d8adccf841351dcf8b76e990dafda6a483c9b045cfbd21c05f9a89a
Opcode Fuzzy Hash: c5f0c382e97445bf1fdad9ea523356781cb8596a76fcd8cb5a790a5f3faa4372
Instruction Fuzzy Hash: 2D31D070B6E003B1FE50AF22D96527E1241EF44BC1F844531E86DAA1D9EE2CFA61E312

Function 00007FF8A7D66890 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D66903
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D66945
GetFullPathNameW.KERNEL32 ref: 00007FF8A7D6696E
GetFullPathNameW.KERNEL32 ref: 00007FF8A7D669A2
wcslen.MSVCRT ref: 00007FF8A7D669C1
_wsopen.MSVCRT ref: 00007FF8A7D669EB
_sopen.MSVCRT ref: 00007FF8A7D66A15
wcslen.MSVCRT ref: 00007FF8A7D66A98
wcscpy.MSVCRT ref: 00007FF8A7D66AE5
wcscat.MSVCRT ref: 00007FF8A7D66AF0
_errno.MSVCRT ref: 00007FF8A7D66B77
wcscpy.MSVCRT ref: 00007FF8A7D66BB8
wcscat.MSVCRT ref: 00007FF8A7D66BC4
_errno.MSVCRT ref: 00007FF8A7D66BCE
_errno.MSVCRT ref: 00007FF8A7D66BE3

Strings

\\?\UNC\, xrefs: 00007FF8A7D66BAE
\\?\, xrefs: 00007FF8A7D66ADB

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno$ByteCharFullMultiNamePathWidewcscatwcscpywcslen$_sopen_wsopen
String ID: \\?\$\\?\UNC\
API String ID: 2611099503-3019864461
Opcode ID: 8b58886237893d285495af4019e8dee8374e10659ea7d6d5ad0572367657074e
Instruction ID: b58275f52e340699a412c935b544b24ceeb4bf74b1ed7420c4d0b42e68d2288f
Opcode Fuzzy Hash: 8b58886237893d285495af4019e8dee8374e10659ea7d6d5ad0572367657074e
Instruction Fuzzy Hash: 5871D721A2A642A1EB60AF55A42477E66D0FF44BE0F449635FE6E077D8EF7CE444E300

Function 00007FF8A7D6E100 Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 302stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00007FF8A7D6E144
strtol.MSVCRT ref: 00007FF8A7D6E178

Strings

cu->cuDevicePrimaryCtxGetState(hwctx->internal->cuda_device, &dev_flags, &dev_active), xrefs: 00007FF8A7D6E308, 00007FF8A7D6E5BC
cu->cuCtxCreate(&hwctx->cuda_ctx, desired_flags, hwctx->internal->cuda_device), xrefs: 00007FF8A7D6E258, 00007FF8A7D6E59C
Using CUDA primary device context, xrefs: 00007FF8A7D6E430
cu->cuInit(0), xrefs: 00007FF8A7D6E1A7, 00007FF8A7D6E555
primary_ctx, xrefs: 00007FF8A7D6E127
Calling %s, xrefs: 00007FF8A7D6E1AE, 00007FF8A7D6E1F1, 00007FF8A7D6E25F, 00007FF8A7D6E29C, 00007FF8A7D6E30F, 00007FF8A7D6E36D, 00007FF8A7D6E4D2
Could not dynamically load CUDA, xrefs: 00007FF8A7D6E48E
cu->cuDeviceGet(&hwctx->internal->cuda_device, device_idx), xrefs: 00007FF8A7D6E1EA, 00007FF8A7D6E57C
Disabling use of CUDA primary device context, xrefs: 00007FF8A7D6E151
cu->cuDevicePrimaryCtxSetFlags(hwctx->internal->cuda_device, desired_flags), xrefs: 00007FF8A7D6E4CB, 00007FF8A7D6E514
cu->cuCtxPopCurrent(&dummy), xrefs: 00007FF8A7D6E295, 00007FF8A7D6E5DC
%s failed, xrefs: 00007FF8A7D6E3C0, 00007FF8A7D6E5E3
-> %s: %s, xrefs: 00007FF8A7D6E3ED, 00007FF8A7D6E610
cu->cuDevicePrimaryCtxRetain(&hwctx->cuda_ctx, hwctx->internal->cuda_device), xrefs: 00007FF8A7D6E366, 00007FF8A7D6E3AF
Primary context already active with incompatible flags., xrefs: 00007FF8A7D6E520

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strtol
String ID: -> %s: %s$%s failed$Calling %s$Could not dynamically load CUDA$Disabling use of CUDA primary device context$Primary context already active with incompatible flags.$Using CUDA primary device context$cu->cuCtxCreate(&hwctx->cuda_ctx, desired_flags, hwctx->internal->cuda_device)$cu->cuCtxPopCurrent(&dummy)$cu->cuDeviceGet(&hwctx->internal->cuda_device, device_idx)$cu->cuDevicePrimaryCtxGetState(hwctx->internal->cuda_device, &dev_flags, &dev_active)$cu->cuDevicePrimaryCtxRetain(&hwctx->cuda_ctx, hwctx->internal->cuda_device)$cu->cuDevicePrimaryCtxSetFlags(hwctx->internal->cuda_device, desired_flags)$cu->cuInit(0)$primary_ctx
API String ID: 76114499-3193254869
Opcode ID: b1d8503496d87b39853df48a8e21de1adfc12c32e64f3833a9af2b5287376059
Instruction ID: ac2fde5d93e653b3c43dbaf10ebeecce8cd94fe665089d96c717a074a8796951
Opcode Fuzzy Hash: b1d8503496d87b39853df48a8e21de1adfc12c32e64f3833a9af2b5287376059
Instruction Fuzzy Hash: BCD1703561AA42A2EA54EF21E4107EE2361FF88BD8F804532EE5E17798DF3DE545E340

Function 00007FF8A7D58700 Relevance: 28.9, APIs: 12, Strings: 7, Instructions: 414stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00007FF8A7D587CB

Strings

<, xrefs: 00007FF8A7D58742
", xrefs: 00007FF8A7D58771, 00007FF8A7D58DC8
, xrefs: 00007FF8A7D589A7, 00007FF8A7D589C5, 00007FF8A7D58AB7, 00007FF8A7D58AD6
>, xrefs: 00007FF8A7D58753
&, xrefs: 00007FF8A7D58926, 00007FF8A7D58C88, 00007FF8A7D58CA0
'\'', xrefs: 00007FF8A7D588BB
', xrefs: 00007FF8A7D58C16

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strchr
String ID: $&$'$>$<$"$'\''
API String ID: 2830005266-2908976646
Opcode ID: 58878a93e8017a577d70043575bf448a998ddca24cee1ed7eb6ac7db7c468040
Instruction ID: 77a20027812c86fa66231ec7d7a11d43bdd868055c6894bb0193e438538238f6
Opcode Fuzzy Hash: 58878a93e8017a577d70043575bf448a998ddca24cee1ed7eb6ac7db7c468040
Instruction Fuzzy Hash: 5BE1BE20F0F2D266FA649E1255513BE2B81EF42FC5F986235DD2D2A3CECD2EB541A341

Function 00007FF8A7D60BA0 Relevance: 28.6, APIs: 19, Instructions: 115COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D60BD6
_aligned_free.MSVCRT ref: 00007FF8A7D60C0D
_aligned_free.MSVCRT ref: 00007FF8A7D60C3D
_aligned_free.MSVCRT ref: 00007FF8A7D60C6D
_aligned_free.MSVCRT ref: 00007FF8A7D60C89
_aligned_free.MSVCRT ref: 00007FF8A7D60C92
_aligned_free.MSVCRT ref: 00007FF8A7D60C9B
_aligned_free.MSVCRT ref: 00007FF8A7D60CA3
_aligned_free.MSVCRT ref: 00007FF8A7D60CAB
_aligned_free.MSVCRT ref: 00007FF8A7D60CB4
_aligned_free.MSVCRT ref: 00007FF8A7D60CBD
_aligned_free.MSVCRT ref: 00007FF8A7D60CC5
_aligned_free.MSVCRT ref: 00007FF8A7D60CCE
_aligned_free.MSVCRT ref: 00007FF8A7D60CD7
_aligned_free.MSVCRT ref: 00007FF8A7D60CE0
_aligned_free.MSVCRT ref: 00007FF8A7D60CE8
_aligned_free.MSVCRT ref: 00007FF8A7D60CF1
_aligned_free.MSVCRT ref: 00007FF8A7D60CFB
_aligned_free.MSVCRT ref: 00007FF8A7D60D05

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: d09f3d952e3eb66ce5eccd33bd3b0168fb06931170680be69507253bbd36f74d
Instruction ID: 778bf3796a079199de7c9be1e110a1a3eafb946ac9d56ab6e7a6505a1431b602
Opcode Fuzzy Hash: d09f3d952e3eb66ce5eccd33bd3b0168fb06931170680be69507253bbd36f74d
Instruction Fuzzy Hash: EC418526B2650163DA40EF11D895E7E2719FF84FD5B024A72EE6D4B399CE38E441E380

Function 00007FF8A7D66650 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7D66890: MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D66903
Part of subcall function 00007FF8A7D66890: MultiByteToWideChar.KERNEL32 ref: 00007FF8A7D66945
Part of subcall function 00007FF8A7D66890: GetFullPathNameW.KERNEL32 ref: 00007FF8A7D6696E
Part of subcall function 00007FF8A7D66890: GetFullPathNameW.KERNEL32 ref: 00007FF8A7D669A2
Part of subcall function 00007FF8A7D66890: wcslen.MSVCRT ref: 00007FF8A7D669C1
Part of subcall function 00007FF8A7D66890: _wsopen.MSVCRT ref: 00007FF8A7D669EB
Part of subcall function 00007FF8A7D66890: _sopen.MSVCRT ref: 00007FF8A7D66A15

_fstat64.MSVCRT ref: 00007FF8A7D666AE
_close.MSVCRT ref: 00007FF8A7D666D7
_get_osfhandle.MSVCRT ref: 00007FF8A7D666F3
CreateFileMappingA.KERNEL32 ref: 00007FF8A7D66718
MapViewOfFile.KERNEL32 ref: 00007FF8A7D66741
CloseHandle.KERNEL32 ref: 00007FF8A7D6674D
_errno.MSVCRT ref: 00007FF8A7D66768
_errno.MSVCRT ref: 00007FF8A7D667B0
_close.MSVCRT ref: 00007FF8A7D667F1

Strings

Error occurred in fstat(): %s, xrefs: 00007FF8A7D667DD
Cannot read file '%s': %s, xrefs: 00007FF8A7D6679A
Error occurred in MapViewOfFile(), xrefs: 00007FF8A7D66831
Error occurred in CreateFileMapping(), xrefs: 00007FF8A7D66800

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: ByteCharFileFullMultiNamePathWide_close_errno$CloseCreateHandleMappingView_fstat64_get_osfhandle_sopen_wsopenwcslen
String ID: Cannot read file '%s': %s$Error occurred in CreateFileMapping()$Error occurred in MapViewOfFile()$Error occurred in fstat(): %s
API String ID: 741575255-3109280323
Opcode ID: 7267cfeadb9c871bf9fb2dec6a57e72c4003b2fad726f8657ee3e356bb816377
Instruction ID: b395d035e105526ba454181e84714f7484a0acf05b04e1e961478b721d428b9d
Opcode Fuzzy Hash: 7267cfeadb9c871bf9fb2dec6a57e72c4003b2fad726f8657ee3e356bb816377
Instruction Fuzzy Hash: 9E419231A1AB86A2F7549F61F4207AE62A4FF84BC8F404135E95E07B98DF7CE505E740

Function 00007FF65EE11A40 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF65EE11A6D

Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1204A
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12065
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12080
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1209B
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE120B6

avformat_network_init.AVFORMAT-60 ref: 00007FF65EE11A85
av_guess_format.AVFORMAT-60 ref: 00007FF65EE11AAF
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE11ABC
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE11AD0
avformat_alloc_output_context2.AVFORMAT-60 ref: 00007FF65EE11AEC
av_strerror.AVUTIL-58 ref: 00007FF65EE11B19
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE11B23
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE11B38

Part of subcall function 00007FF65EE12910: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF65EE11B4C), ref: 00007FF65EE12939

Part of subcall function 00007FF65EE12370: avcodec_free_context.AVCODEC-60 ref: 00007FF65EE12388
Part of subcall function 00007FF65EE12370: av_free.AVUTIL-58 ref: 00007FF65EE123B1
Part of subcall function 00007FF65EE12370: avio_context_free.AVFORMAT-60 ref: 00007FF65EE123BD
Part of subcall function 00007FF65EE12370: avformat_free_context.AVFORMAT-60 ref: 00007FF65EE123CC
Part of subcall function 00007FF65EE12370: avcodec_free_context.AVCODEC-60 ref: 00007FF65EE12402
Part of subcall function 00007FF65EE12370: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE12415

Strings

Couldn't initialize output context: %s, xrefs: 00007FF65EE11B31
http, xrefs: 00007FF65EE11A5C
mpegts, xrefs: 00007FF65EE11A92
Couldn't find an appropriate muxer for '%s', xrefs: 00007FF65EE11AC6
video/M2PT, xrefs: 00007FF65EE11A9C

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strncmp$__acrt_iob_funcavcodec_free_contextfprintf$av_freeav_guess_formatav_strerroravformat_alloc_output_context2avformat_free_contextavformat_network_initavio_context_freecallocfree
String ID: Couldn't find an appropriate muxer for '%s'$Couldn't initialize output context: %s$http$mpegts$video/M2PT
API String ID: 3777911973-2524251934
Opcode ID: 078559d49e555ef7517477361438487f95b7fa6d5945ffa6822e70d97715306d
Instruction ID: 2ae9c6e99cb47465e2eb7d668e68cc7e4cc92e9e32b0e619ca9dd3d2f1f07b8d
Opcode Fuzzy Hash: 078559d49e555ef7517477361438487f95b7fa6d5945ffa6822e70d97715306d
Instruction Fuzzy Hash: 2F311711F3876382FE189BA5AE002B92350AFA9794F585235FD4DE72D5EFACE4C48700

Function 00007FF8A7D7EA60 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 176stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D7EAAA
strchr.MSVCRT ref: 00007FF8A7D7EAE4
strlen.MSVCRT ref: 00007FF8A7D7EB01
strtoul.MSVCRT ref: 00007FF8A7D7EB65

Strings

0123456789ABCDEFabcdef, xrefs: 00007FF8A7D7EC1C
Cannot find color '%s', xrefs: 00007FF8A7D7ED2A
Invalid 0xRRGGBB[AA] color string: '%s', xrefs: 00007FF8A7D7ED09
bikeshed, xrefs: 00007FF8A7D7EB20
Invalid alpha value specifier '%s' in '%s', xrefs: 00007FF8A7D7ECF0
random, xrefs: 00007FF8A7D7EB0A

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strlen$strchrstrtoul
String ID: 0123456789ABCDEFabcdef$Cannot find color '%s'$Invalid 0xRRGGBB[AA] color string: '%s'$Invalid alpha value specifier '%s' in '%s'$bikeshed$random
API String ID: 643661298-1323625105
Opcode ID: 05b314dcd31ff43a5f327d01538bb3f4bf05cbc92719439464dceff93f7a60bd
Instruction ID: 2cd84c15166e3756a987f4f939cfceb7f7e80e7f57afac72be06237c0d7465d5
Opcode Fuzzy Hash: 05b314dcd31ff43a5f327d01538bb3f4bf05cbc92719439464dceff93f7a60bd
Instruction Fuzzy Hash: 85712622E1F68265FB619F21941177E6B91EF81BC4F488732E9AE077C9DE7CE440A340

Function 00007FF65EE114B0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 164COMMON

Download Yara Rule

APIs

avcodec_descriptor_get_by_name.AVCODEC-60 ref: 00007FF65EE114C9
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE114D9
av_memdup.AVUTIL-58 ref: 00007FF65EE1152F
avcodec_alloc_context3.AVCODEC-60 ref: 00007FF65EE11539
av_content_light_metadata_alloc.AVUTIL-58 ref: 00007FF65EE11610
av_stream_add_side_data.AVFORMAT-60 ref: 00007FF65EE1162B
av_mastering_display_metadata_alloc.AVUTIL-58 ref: 00007FF65EE11630

Strings

2, xrefs: 00007FF65EE116C5
Couldn't find codec '%s', xrefs: 00007FF65EE114E2
E, xrefs: 00007FF65EE1168B

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: __acrt_iob_funcav_content_light_metadata_allocav_mastering_display_metadata_allocav_memdupav_stream_add_side_dataavcodec_alloc_context3avcodec_descriptor_get_by_name
String ID: 2$Couldn't find codec '%s'$E
API String ID: 3726879996-2734579634
Opcode ID: 984bf621481a9a25f05ee9f8f0874bf5fd16c3df77fd558344dbfddc274f0f6a
Instruction ID: beb2183725623dc8549ee29c87eca011627f9168a8851317c6c5a2884cb11bd6
Opcode Fuzzy Hash: 984bf621481a9a25f05ee9f8f0874bf5fd16c3df77fd558344dbfddc274f0f6a
Instruction Fuzzy Hash: 1381E376609B808BDB54CF65E64435DBBB0F789B88F14402AEB8C87B58DF7AD854CB00

Function 00007FF65EE11250 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

avcodec_descriptor_get_by_name.AVCODEC-60 ref: 00007FF65EE1126F
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE1127F
avcodec_find_encoder.AVCODEC-60 ref: 00007FF65EE112A9
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF65EE112B9

Strings

title, xrefs: 00007FF65EE1131D
Couldn't find codec descriptor '%s', xrefs: 00007FF65EE11288
Couldn't find codec '%s', xrefs: 00007FF65EE112C2

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: __acrt_iob_func$avcodec_descriptor_get_by_nameavcodec_find_encoder
String ID: Couldn't find codec '%s'$Couldn't find codec descriptor '%s'$title
API String ID: 3715327632-3279048111
Opcode ID: c9720edbb9d548ebec2452977bce4eb4d803eed367fb80ba86fd3ea18017a218
Instruction ID: 9d1f22f9773089adbbb983d168b5c751582fc58c8dd98b598cbe082b3906a006
Opcode Fuzzy Hash: c9720edbb9d548ebec2452977bce4eb4d803eed367fb80ba86fd3ea18017a218
Instruction Fuzzy Hash: 4C61BD72614B8186DB08CF56EA903AD7761FB98B94F094039EF4E97758DFB8E095C700

Function 00007FF8A7D93CB0 Relevance: 21.1, APIs: 14, Instructions: 123COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D93D1B
_aligned_free.MSVCRT ref: 00007FF8A7D93D23

Part of subcall function 00007FF8A7D93CB0: _aligned_free.MSVCRT ref: 00007FF8A7D93CF9

_aligned_free.MSVCRT ref: 00007FF8A7D93D4D
_aligned_free.MSVCRT ref: 00007FF8A7D93D6F
_aligned_free.MSVCRT ref: 00007FF8A7D93D77
_aligned_free.MSVCRT ref: 00007FF8A7D93D7F
_aligned_free.MSVCRT ref: 00007FF8A7D93DB7
_aligned_free.MSVCRT ref: 00007FF8A7D93DD9
_aligned_free.MSVCRT ref: 00007FF8A7D93DE1
_aligned_free.MSVCRT ref: 00007FF8A7D93E0B
_aligned_free.MSVCRT ref: 00007FF8A7D93E2D
_aligned_free.MSVCRT ref: 00007FF8A7D93E35
_aligned_free.MSVCRT ref: 00007FF8A7D93E3D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: 9507d53f166a1d0254cdadf622783abd4b684d210657e614246861b7e6ebef3c
Instruction ID: 73c9118972d6a7b44dbd2007fa270e0fb592ceca103154343984fd836bbd4854
Opcode Fuzzy Hash: 9507d53f166a1d0254cdadf622783abd4b684d210657e614246861b7e6ebef3c
Instruction Fuzzy Hash: 75411C11B1BC6261E945EF13C46657E176CEF85FD0B068A32DE6D4B78ACF38E845A380

Function 00007FF65EE117A0 Relevance: 19.6, APIs: 13, Instructions: 72COMMON

Download Yara Rule

APIs

av_write_trailer.AVFORMAT-60 ref: 00007FF65EE117B5
pthread_mutex_lock.W32-PTHREADS ref: 00007FF65EE117DE
os_event_signal.OBS ref: 00007FF65EE117EA
pthread_mutex_unlock.W32-PTHREADS ref: 00007FF65EE117F6
pthread_join.W32-PTHREADS ref: 00007FF65EE1180E
os_event_destroy.OBS ref: 00007FF65EE1181A
os_event_destroy.OBS ref: 00007FF65EE11826
pthread_mutex_destroy.W32-PTHREADS ref: 00007FF65EE11832
bfree.OBS ref: 00007FF65EE1183E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE118A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE118BA
bfree.OBS ref: 00007FF65EE118C4
av_packet_free.AVCODEC-60 ref: 00007FF65EE118E5

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: bfreefreeos_event_destroy$av_packet_freeav_write_traileros_event_signalpthread_joinpthread_mutex_destroypthread_mutex_lockpthread_mutex_unlock
String ID:
API String ID: 3736584056-0
Opcode ID: 8bdf6fd2e92e54ef71616242ce810bf52dd6c25259264d2bdbef31b8de60417c
Instruction ID: 9c0fc18083849f650c53012ba2ff50fc7f0386a5f2ab88c47dbdcee3784429f1
Opcode Fuzzy Hash: 8bdf6fd2e92e54ef71616242ce810bf52dd6c25259264d2bdbef31b8de60417c
Instruction Fuzzy Hash: 75315222E2869281EB49EF70C9513F82361FFA4B48F4C4131EE4DAA19ADFA8D5C58351

Function 00007FF8A7D5AE10 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 151stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D5AE26
memcmp.MSVCRT ref: 00007FF8A7D5AEA5

Strings

mono, xrefs: 00007FF8A7D5AE70

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcmpstrlen
String ID: mono
API String ID: 3108337309-2381334079
Opcode ID: 4442f9bb683f4af6272261eaf8af414874aa53633c76ffc30400c404e096c1e0
Instruction ID: 3ebeffe04cb56ba0af8e240599d747b2fe4853ac1a698799b2674a19fc1ed66f
Opcode Fuzzy Hash: 4442f9bb683f4af6272261eaf8af414874aa53633c76ffc30400c404e096c1e0
Instruction Fuzzy Hash: FC51E462B0B59367FA609F15D4142BE6B90EB45BC0F8D5132EE1D4B388DE3CE455A300

Function 00007FF8A7D5F360 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 170stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7D778F0: strlen.MSVCRT ref: 00007FF8A7D778FF
Part of subcall function 00007FF8A7D778F0: _aligned_realloc.MSVCRT ref: 00007FF8A7D7791F
Part of subcall function 00007FF8A7D778F0: memcpy.MSVCRT ref: 00007FF8A7D77936

_aligned_free.MSVCRT ref: 00007FF8A7D5F410
_aligned_free.MSVCRT ref: 00007FF8A7D5F418
_aligned_free.MSVCRT ref: 00007FF8A7D5F49B
_aligned_free.MSVCRT ref: 00007FF8A7D5F4A5
_aligned_free.MSVCRT ref: 00007FF8A7D5F51E
_aligned_free.MSVCRT ref: 00007FF8A7D5F528
strlen.MSVCRT ref: 00007FF8A7D5F5C0
strlen.MSVCRT ref: 00007FF8A7D5F5CB
memcpy.MSVCRT ref: 00007FF8A7D5F5F9

Strings

%lld, xrefs: 00007FF8A7D5F386

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free$strlen$memcpy$_aligned_realloc
String ID: %lld
API String ID: 3853940031-1962030014
Opcode ID: 8ef0d90d922d738ed908a9e8d1ebc5c3fb02acdd9b45e12231443154cef6d25c
Instruction ID: f575d9919c380d861bd158112361129c35cde5752a2e690ee95b88744d28b95a
Opcode Fuzzy Hash: 8ef0d90d922d738ed908a9e8d1ebc5c3fb02acdd9b45e12231443154cef6d25c
Instruction Fuzzy Hash: 10618122A0B68262EA64DE15E51077E6391FF44BE4F045B31EEAD4B789EF3CE550E340

Function 00007FF8A7E0AF60 Relevance: 16.7, APIs: 11, Instructions: 159sleepCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 00007FF8A7E0AFE2
Sleep.KERNEL32 ref: 00007FF8A7E0AFF7

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: e5aaf2775736aee3134771c4ec912a0918e928d2149e6c1679b1ab5e8eb6a53e
Instruction ID: d182754fb074bd4c67aad5ac4d4a8f74bccfb73cb6d8a61f0189cb052f3683b7
Opcode Fuzzy Hash: e5aaf2775736aee3134771c4ec912a0918e928d2149e6c1679b1ab5e8eb6a53e
Instruction Fuzzy Hash: 5751AF32A4A64296E7618F20E858BAF32A5FB44BF4F054335DE29473D4DF3C9896E300

Function 00007FF8A7DF9990 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7DF9AF8

Strings

-, xrefs: 00007FF8A7DF9A98

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: -
API String ID: 2918714741-2547889144
Opcode ID: f978b8ec28ce8a6f9b5e47dd2052fece94246ae97b2b9cc28d4a0647f4bf6175
Instruction ID: 340172ab97ae67e58869a8b5999b09af2a33c052079651ce175c4dbb520f07df
Opcode Fuzzy Hash: f978b8ec28ce8a6f9b5e47dd2052fece94246ae97b2b9cc28d4a0647f4bf6175
Instruction Fuzzy Hash: 4B51E132E0F25761FA254F2554503BD2A81EF01BEAF494730CD7F8A2C9DEACE841A300

Function 00007FF8A7DF9BF0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7DF9D38

Strings

-, xrefs: 00007FF8A7DF9CFA
ambisonic , xrefs: 00007FF8A7DF9BF9

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: -$ambisonic
API String ID: 2918714741-2876420257
Opcode ID: c1d0ba877cb9a5e33fb598b34b3d9939bb9d6dbd7a5e029ec6c2859871519c45
Instruction ID: f59e22ed3c1ffa79065d6ae8fe9a45a1902a764eb74646fd236c05dcfa7924e4
Opcode Fuzzy Hash: c1d0ba877cb9a5e33fb598b34b3d9939bb9d6dbd7a5e029ec6c2859871519c45
Instruction Fuzzy Hash: 18411362E0F15221FB644F2548583BD26C5EF017E6F594B32DD3F8A2C8EDACE441A710

Function 00007FF8A7D7D3D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 110stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7D55FB0: strlen.MSVCRT ref: 00007FF8A7D55FC9

strspn.MSVCRT ref: 00007FF8A7D7D44B
_aligned_free.MSVCRT ref: 00007FF8A7D7D4BB
_aligned_free.MSVCRT ref: 00007FF8A7D7D4C3
_aligned_free.MSVCRT ref: 00007FF8A7D7D544
_aligned_free.MSVCRT ref: 00007FF8A7D7D54C
_aligned_free.MSVCRT ref: 00007FF8A7D7D57A

Strings

Missing key or no key/value separator found after key '%s', xrefs: 00007FF8A7D7D55B
Setting entry with key '%s' to value '%s', xrefs: 00007FF8A7D7D40E
Key '%s' not found., xrefs: 00007FF8A7D7D525

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free$strlenstrspn
String ID: Key '%s' not found.$Missing key or no key/value separator found after key '%s'$Setting entry with key '%s' to value '%s'
API String ID: 1832283230-2858522012
Opcode ID: 6858625f83de9048fadb2900624906809c4cd63edab14c6c68f5989beb2d347c
Instruction ID: 4e672a5b0b9d495f11e1f4fd91cc4adddafa3e739dabd51b7c804f2560a91c3b
Opcode Fuzzy Hash: 6858625f83de9048fadb2900624906809c4cd63edab14c6c68f5989beb2d347c
Instruction Fuzzy Hash: AB41F551A0E68275FA61AE12A8017BE5750FF85BD8F944A35EDAE0779ACD3CE044E340

Function 00007FF8A7D79900 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 317stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D799A4

Strings

%c%c%c%c%c%c%c%c%c%c%c, xrefs: 00007FF8A7D79B55
%-12s , xrefs: 00007FF8A7D79A5D
%s%-17s , xrefs: 00007FF8A7D79A3D
%-15s , xrefs: 00007FF8A7D799B0
(default , xrefs: 00007FF8A7D79D46
I, xrefs: 00007FF8A7D79D30
(from , xrefs: 00007FF8A7D79C1B
to , xrefs: 00007FF8A7D79C59
%s, xrefs: 00007FF8A7D79B9A

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: %-15s $ %s%-17s $ %s$ (default $ (from $ I$ to $%-12s $%c%c%c%c%c%c%c%c%c%c%c
API String ID: 1004003707-1704579004
Opcode ID: 2ea16860b3427611d439ee252ee5f1f96aacb857c5cfc9ddd7f0c0fe524bede6
Instruction ID: 984d3b79a39030cb51e96d3963431e7e4d33f2e13e7812c7a156606ff396f899
Opcode Fuzzy Hash: 2ea16860b3427611d439ee252ee5f1f96aacb857c5cfc9ddd7f0c0fe524bede6
Instruction Fuzzy Hash: 9BC1F473B0AA42AAEB149F25E4407BE2761FB80BD5F548235DA1E47B98EF3CE440D740

Function 00007FF8A7D5F640 Relevance: 15.2, APIs: 10, Instructions: 244stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7D55FB0: strlen.MSVCRT ref: 00007FF8A7D55FC9

strspn.MSVCRT ref: 00007FF8A7D5F71E
_aligned_free.MSVCRT ref: 00007FF8A7D5F7E5
_aligned_free.MSVCRT ref: 00007FF8A7D5F7ED

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free$strlenstrspn
String ID:
API String ID: 1832283230-0
Opcode ID: 26bc88a9fd69d679ea30a0b0f13b4c0f719b999fe5c0e19c8c29863e318b563f
Instruction ID: 1a433cc82f495f7f622b28a35f8fb0b491ce0da5812c94409b7a5673d56a4025
Opcode Fuzzy Hash: 26bc88a9fd69d679ea30a0b0f13b4c0f719b999fe5c0e19c8c29863e318b563f
Instruction Fuzzy Hash: 24A15F62A0BB82A2EA10DF11E45037EA795EF84BD0F445635EA9D4B79DDE3CE440E740

Function 00007FF8A7D609B0 Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D60AA6
_aligned_free.MSVCRT ref: 00007FF8A7D60ADD
_aligned_free.MSVCRT ref: 00007FF8A7D60AFA
_aligned_free.MSVCRT ref: 00007FF8A7D60B03
_aligned_free.MSVCRT ref: 00007FF8A7D60B0C
_aligned_free.MSVCRT ref: 00007FF8A7D60B14
_aligned_free.MSVCRT ref: 00007FF8A7D60B1D
_aligned_free.MSVCRT ref: 00007FF8A7D60B27
_aligned_free.MSVCRT ref: 00007FF8A7D60B31
_aligned_free.MSVCRT ref: 00007FF8A7D60B3C

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: 5319d01e5d1025e7fc0068ae3d94082f79af11993daff4612deb7ef89ba06dda
Instruction ID: d00c84c32248b9732b696238a022dd9d7e7a8b5844c0309bdfd93128df80da44
Opcode Fuzzy Hash: 5319d01e5d1025e7fc0068ae3d94082f79af11993daff4612deb7ef89ba06dda
Instruction Fuzzy Hash: B641C922B2670662EA51AF15C545F7F2799EF84BD4F054A36ED2D07389DE78E840E380

Function 00007FF8A7E09840 Relevance: 15.1, APIs: 10, Instructions: 100COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF8A7E0985D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: de550876fdf94b650e17a9c6284cbc8fe7517bb1ab88a7b2ec8df1b363e153e6
Instruction ID: 9cc005283bfc8dac00ae3c4e17252225c5d9a2916f728bbca48e8f86705ca59b
Opcode Fuzzy Hash: de550876fdf94b650e17a9c6284cbc8fe7517bb1ab88a7b2ec8df1b363e153e6
Instruction Fuzzy Hash: 34316672A0AA42AAEB509F31E80476E36A0FB44BE9F041239DD0D073E4DF3CE955D710

Function 00007FF65EE12030 Relevance: 15.0, APIs: 5, Strings: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1204A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12065
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12080
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1209B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE120B6

Strings

udp, xrefs: 00007FF65EE12058
http, xrefs: 00007FF65EE1208E
rist, xrefs: 00007FF65EE120A9
srt, xrefs: 00007FF65EE12039
tcp, xrefs: 00007FF65EE12073

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strncmp
String ID: http$rist$srt$tcp$udp
API String ID: 1114863663-504309389
Opcode ID: d2521f5543573ed7a9b47c763349208ce3ea302e6d5c14a99d4cb2250db2cd2e
Instruction ID: 0033f9eacd7e10fb62ef411f774c2438286117cf6cbde9c731e681f5648671ea
Opcode Fuzzy Hash: d2521f5543573ed7a9b47c763349208ce3ea302e6d5c14a99d4cb2250db2cd2e
Instruction Fuzzy Hash: 02013091B2452380FF654FD2DA402241360AF6DB95F886139D94EE7254DFADE6DEC320

Function 00007FF8A7D71E20 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 248COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D72154

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7D72182
((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth, xrefs: 00007FF8A7D72176
((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth, xrefs: 00007FF8A7D721A6
src/libavutil/imgutils.c, xrefs: 00007FF8A7D72167, 00007FF8A7D72197
av_image_get_linesize failed, xrefs: 00007FF8A7D720D0

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpy
String ID: ((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth$((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth$Assertion %s failed at %s:%d$av_image_get_linesize failed$src/libavutil/imgutils.c
API String ID: 3510742995-882259572
Opcode ID: 0f20995bfb48e77148fec557d5fbaa226202661854b0129ced2db76bb94dc692
Instruction ID: af89ffcdcc9e038fc7612dc5ff7853e9c0a6fd74cc1e2315fc1610efe7cf7cf3
Opcode Fuzzy Hash: 0f20995bfb48e77148fec557d5fbaa226202661854b0129ced2db76bb94dc692
Instruction Fuzzy Hash: 52A1AF73A0A79596EA148F15A94026EB7A1FB84BD0F084235EF9D17B98DF3CF441E700

Function 00007FF8A7D71A70 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 243COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D71B99
memcpy.MSVCRT ref: 00007FF8A7D71D31
abort.MSVCRT ref: 00007FF8A7D71DF2

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7D71DE2
((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth, xrefs: 00007FF8A7D71E06
((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth, xrefs: 00007FF8A7D71DD6
src/libavutil/imgutils.c, xrefs: 00007FF8A7D71DC7, 00007FF8A7D71DF7
av_image_get_linesize failed, xrefs: 00007FF8A7D71D93

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpy$abort
String ID: ((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth$((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth$Assertion %s failed at %s:%d$av_image_get_linesize failed$src/libavutil/imgutils.c
API String ID: 3629556515-882259572
Opcode ID: 720129b710e5ed98a497ce0c61193de95d3f52df19d8a310f2021f8bda355e19
Instruction ID: 45d3cca364380d271d7dce8030d138b35f9462454047371bd2b07851000f89cc
Opcode Fuzzy Hash: 720129b710e5ed98a497ce0c61193de95d3f52df19d8a310f2021f8bda355e19
Instruction Fuzzy Hash: 58A1A632A0AB8596DB648F15E54036EB7A0FB85BD0F184239DE9D43B98EF3DE441DB00

Function 00007FF8A7D7D5B0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7D7C1D0: strspn.MSVCRT ref: 00007FF8A7D7C1FC
Part of subcall function 00007FF8A7D7C1D0: strspn.MSVCRT ref: 00007FF8A7D7C245
Part of subcall function 00007FF8A7D7C1D0: strchr.MSVCRT ref: 00007FF8A7D7C25D
Part of subcall function 00007FF8A7D7C1D0: memcpy.MSVCRT ref: 00007FF8A7D7C28C

_aligned_free.MSVCRT ref: 00007FF8A7D7D678
_aligned_free.MSVCRT ref: 00007FF8A7D7D682
_aligned_free.MSVCRT ref: 00007FF8A7D7D72C
_aligned_free.MSVCRT ref: 00007FF8A7D7D736

Strings

Setting '%s' to value '%s', xrefs: 00007FF8A7D7D620
Option '%s' not found, xrefs: 00007FF8A7D7D832
No option name near '%s', xrefs: 00007FF8A7D7D7FC
Unable to parse '%s': %s, xrefs: 00007FF8A7D7D7E3

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free$strspn$memcpystrchr
String ID: No option name near '%s'$Option '%s' not found$Setting '%s' to value '%s'$Unable to parse '%s': %s
API String ID: 2931229598-2003673103
Opcode ID: 5496a8e94afb4b653dcbea0521884cd186c85a6990d9a2e756bf1473de833a0d
Instruction ID: 14b382954762daabbacde6a1924630e7f82413e7f123ce251b7747057d915003
Opcode Fuzzy Hash: 5496a8e94afb4b653dcbea0521884cd186c85a6990d9a2e756bf1473de833a0d
Instruction Fuzzy Hash: 9E519132609B86A1E7609F11E8507AEA7A0FB847D8F404236EEDD4BB98DF7CD444E740

Function 00007FF8A7DD44C0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 142COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7DD45DA

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7DD45C6
src/libavutil/utils.c, xrefs: 00007FF8A7DD45AF
[%d], xrefs: 00007FF8A7DD4603
!"valid element size", xrefs: 00007FF8A7DD45B6
. -_, xrefs: 00007FF8A7DD468B
D, xrefs: 00007FF8A7DD45CD

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: !"valid element size"$. -_$Assertion %s failed at %s:%d$D$[%d]$src/libavutil/utils.c
API String ID: 4206212132-1952739643
Opcode ID: 8dda062a40ab2f67f05643896e4bd6b922d436051c7bb03a64cbc94b01d14da1
Instruction ID: 64d30f9d6154166f906c69a06bd953ab97c7668096aaf31b9f15f27f632e3873
Opcode Fuzzy Hash: 8dda062a40ab2f67f05643896e4bd6b922d436051c7bb03a64cbc94b01d14da1
Instruction Fuzzy Hash: C351F6B6E0B65A65EA209F51A500A7D3F90FB55FC4F494334CE1E43789EE3CB495D200

Function 00007FF8BFAB63B0 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8BFAB63D8
__scrt_initialize_crt.LIBCMT ref: 00007FF8BFAB641D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8BFAB642A
_RTC_Initialize.LIBCMT ref: 00007FF8BFAB6458
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8BFAB647E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8BFAB64A9

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 05d8b91213d8a4974e84562f7c7d5bb031e6d637f96e7ddce6b44401f1817edf
Instruction ID: 21e9dfce17f3cdeba8a57b3991693f031a222c3ea2927797eb642a60758b971a
Opcode Fuzzy Hash: 05d8b91213d8a4974e84562f7c7d5bb031e6d637f96e7ddce6b44401f1817edf
Instruction Fuzzy Hash: 12816E21E0CE4385FA5CABED98532B96790AF89BC8F086175DB0D43397DE3DE8458700

Function 00007FF8A7D5FAD0 Relevance: 13.7, APIs: 9, Instructions: 221COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D5FBE6
_aligned_free.MSVCRT ref: 00007FF8A7D5FBF0
_aligned_free.MSVCRT ref: 00007FF8A7D5FC3D
_aligned_free.MSVCRT ref: 00007FF8A7D5FC45

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: bb8437b69a084f07a8ed3204e31c2741436194e29f9f638b4584538b28a8ba08
Instruction ID: 1f5faf374961e819af09377e2c558d5affebd544e8c429ac47bcc02d523082d5
Opcode Fuzzy Hash: bb8437b69a084f07a8ed3204e31c2741436194e29f9f638b4584538b28a8ba08
Instruction Fuzzy Hash: CA819032A0B682A2EB109F12E55077E6790FF84BD0F445A35EEAD4B789DE3CE450E740

Function 00007FF8A7D5F080 Relevance: 13.7, APIs: 9, Instructions: 181COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D5F10E
_aligned_free.MSVCRT ref: 00007FF8A7D5F118
_aligned_free.MSVCRT ref: 00007FF8A7D5F157
_aligned_free.MSVCRT ref: 00007FF8A7D5F15F

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: 01f721f6df29f9dd6bf7ef2f97b91fefc10836ccc23b581315bb421e2c98f023
Instruction ID: d8b7c3269a645da5fba282cb723567235bbb5fb562665614cc2d4c19a3bacc82
Opcode Fuzzy Hash: 01f721f6df29f9dd6bf7ef2f97b91fefc10836ccc23b581315bb421e2c98f023
Instruction Fuzzy Hash: 72618F26A0BA8263EA249E16E45077E6790FF48BD8F045731DEAD4F7C9DE2CE441A340

Function 00007FF8A7D79D80 Relevance: 13.6, APIs: 2, Strings: 7, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D799A4
strcmp.MSVCRT ref: 00007FF8A7D79DD7

Strings

%-15s , xrefs: 00007FF8A7D799B0
UINT32_MAX, xrefs: 00007FF8A7D7A2E8
I64_MAX, xrefs: 00007FF8A7D7A31A
%lld, xrefs: 00007FF8A7D7A29D
INT_MIN, xrefs: 00007FF8A7D7A301
I64_MIN, xrefs: 00007FF8A7D7A2CF
INT_MAX, xrefs: 00007FF8A7D7A2B6

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: %-15s $%lld$I64_MAX$I64_MIN$INT_MAX$INT_MIN$UINT32_MAX
API String ID: 1004003707-1419900426
Opcode ID: 60724dc2eec3de23298e2ae44bcb11fdf03ae2348c3838bc2f08ec1f1516dc3e
Instruction ID: 7388702a39707a035f802d69fa87f2f68a28c5e6e1ba51604924ae6fbdac4d1a
Opcode Fuzzy Hash: 60724dc2eec3de23298e2ae44bcb11fdf03ae2348c3838bc2f08ec1f1516dc3e
Instruction Fuzzy Hash: 67517F32A0F642AAEB64AE15A1003BE2360EF817D5F945332DA2D576D9DF3DF450E381

Function 00007FF65EE12160 Relevance: 13.6, APIs: 9, Instructions: 98COMMON

Download Yara Rule

APIs

pthread_mutex_lock.W32-PTHREADS ref: 00007FF65EE121BB
os_event_reset.OBS ref: 00007FF65EE121E7
pthread_mutex_unlock.W32-PTHREADS ref: 00007FF65EE121F3
os_event_wait.OBS ref: 00007FF65EE121FF
pthread_mutex_lock.W32-PTHREADS ref: 00007FF65EE1220B
memcpy.VCRUNTIME140 ref: 00007FF65EE1227B
memcpy.VCRUNTIME140 ref: 00007FF65EE1228E
os_event_signal.OBS ref: 00007FF65EE122D1
pthread_mutex_unlock.W32-PTHREADS ref: 00007FF65EE122DD

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpypthread_mutex_lockpthread_mutex_unlock$os_event_resetos_event_signalos_event_wait
String ID:
API String ID: 2918620995-0
Opcode ID: 2ecd02ec26d4cc9ba7addf2ffba6d2c38598a6939d4a4f97ceb40f02c73610ba
Instruction ID: 7e4f7b1ce07ace2f1bf73b1400e67cffdb593a4e35d9b73b16e08166c4576e60
Opcode Fuzzy Hash: 2ecd02ec26d4cc9ba7addf2ffba6d2c38598a6939d4a4f97ceb40f02c73610ba
Instruction Fuzzy Hash: 7F415232A28A9181DA14DF61E5503AD6761FBA9B98F480032FF8D57B5ACF7CD5D4C700

Function 00007FF8A7E07C30 Relevance: 13.6, APIs: 9, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7E07B90: EnterCriticalSection.KERNEL32(?,?,?,?,00007FF8A7E07EA7,?,?,?,?,?,?,?,?,00007FF8A7D91502), ref: 00007FF8A7E07BB6
Part of subcall function 00007FF8A7E07B90: LeaveCriticalSection.KERNEL32(?,?,00007FF8A7E07EA7,?,?,?,?,?,?,?,?,00007FF8A7D91502), ref: 00007FF8A7E07BDB

TryEnterCriticalSection.KERNEL32 ref: 00007FF8A7E07CB0
CloseHandle.KERNEL32(?,?,?,?,?,?,00007FF8A7D91817), ref: 00007FF8A7E07CF8
CloseHandle.KERNEL32(?,?,?,?,?,?,00007FF8A7D91817), ref: 00007FF8A7E07D02
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7E07D07
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF8A7D91817), ref: 00007FF8A7E07D17
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF8A7D91817), ref: 00007FF8A7E07D1C
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF8A7D91817), ref: 00007FF8A7E07D23
free.MSVCRT ref: 00007FF8A7E07D28

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CriticalSection$Delete$CloseEnterHandleLeave$free
String ID:
API String ID: 3899327206-0
Opcode ID: 2505bcbe3cd4d1a469b291fb81c03ba1909a3890b205137eb9b30536ece67948
Instruction ID: e84f6f121b03fae05c259eba654987b26a75a56a871ee608b84c8f92f1b05b05
Opcode Fuzzy Hash: 2505bcbe3cd4d1a469b291fb81c03ba1909a3890b205137eb9b30536ece67948
Instruction Fuzzy Hash: FA314931B4A942A1EA509B62D8587AE2794FF45FE9F844631DD2E432D1CE3CD953A300

Function 00007FF65EE135E4 Relevance: 13.6, APIs: 9, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF65EE135F8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF65EE1360D
__scrt_release_startup_lock.LIBCMT ref: 00007FF65EE1367B
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE136C9
_get_initial_wide_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE136CE
__p___wargv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE136D6
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE136DE
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE13700
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF65EE1375A

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: __p___argc__p___wargv__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_release_startup_lock_cexit_exit_get_initial_wide_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1184979102-0
Opcode ID: d1267e791b308d50114738cb6d3fcce0682459912f5f90b2ba963487117e6561
Instruction ID: e2d96a701b445b4710fa7a6ea274e8a72518ae49e530c2ab89a68ce36d4c5f24
Opcode Fuzzy Hash: d1267e791b308d50114738cb6d3fcce0682459912f5f90b2ba963487117e6561
Instruction Fuzzy Hash: 30314C61E2822241FE1CABA196513B92291AF71784F4D4034F64EF73D7DEECECC58611

Function 00007FF8A7DF87A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF8A7DF88B9

Strings

Address %p has no image-section, xrefs: 00007FF8A7DF8810, 00007FF8A7DF8A20
VirtualProtect failed with code 0x%x, xrefs: 00007FF8A7DF89B2
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF8A7DF8A0C
Mingw-w64 runtime failure:, xrefs: 00007FF8A7DF87D8

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: a8cae70abf7ffee8518c3ea9921427e896fff9301f328d805a1cc0052b195cee
Instruction ID: 9bac1f51b6695f4615d6078dc86f9d5a64278ad9125deb841015a0f9231e3700
Opcode Fuzzy Hash: a8cae70abf7ffee8518c3ea9921427e896fff9301f328d805a1cc0052b195cee
Instruction Fuzzy Hash: B061CF72B1AB42A6EB108F25E88426D77A0FB45BD0F544235EAAD17398EE7CE541E301

Function 00007FF8A7D6D650 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF8A7D6D6EA
free.MSVCRT ref: 00007FF8A7D6D6F3

Strings

cu->cuCtxDestroy(hwctx->cuda_ctx), xrefs: 00007FF8A7D6D68E, 00007FF8A7D6D7DF
cu->cuDevicePrimaryCtxRelease(hwctx->internal->cuda_device), xrefs: 00007FF8A7D6D721, 00007FF8A7D6D76A
%s failed, xrefs: 00007FF8A7D6D771
-> %s: %s, xrefs: 00007FF8A7D6D79E
Calling %s, xrefs: 00007FF8A7D6D695, 00007FF8A7D6D728

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: FreeLibraryfree
String ID: -> %s: %s$%s failed$Calling %s$cu->cuCtxDestroy(hwctx->cuda_ctx)$cu->cuDevicePrimaryCtxRelease(hwctx->internal->cuda_device)
API String ID: 155010425-3275200884
Opcode ID: 5bf74a7dc137a0c155993daea2b6d87e70908d77a28ad94112a4fe68d911b2e3
Instruction ID: 1ce8b05bfe9d6d24a7069b9b705586926ced893cffb375dbc52ff0960e75ea4f
Opcode Fuzzy Hash: 5bf74a7dc137a0c155993daea2b6d87e70908d77a28ad94112a4fe68d911b2e3
Instruction Fuzzy Hash: 59418235A1BA86A1EA58EF61E4107AE2351FF44BD8F444132EE6E17358CF3CE955D340

Function 00007FF8A7DF9860 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7DF9878
_errno.MSVCRT ref: 00007FF8A7DF9897
rand.MSVCRT ref: 00007FF8A7DF9910
_sopen.MSVCRT ref: 00007FF8A7DF995F
_errno.MSVCRT ref: 00007FF8A7DF9970

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FF8A7DF98FE
XXXX, xrefs: 00007FF8A7DF988F

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno$_sopenrandstrlen
String ID: XXXX$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
API String ID: 1081397658-1416102993
Opcode ID: 7ac93ad39a8cb676dc86535b40274021b571b1fd82cfda16182900e2eb2af889
Instruction ID: be50bab725f0da3e5d6f856525a80c8832eae713f259cfbbe1416be0adff2af4
Opcode Fuzzy Hash: 7ac93ad39a8cb676dc86535b40274021b571b1fd82cfda16182900e2eb2af889
Instruction Fuzzy Hash: D8318B73E0A55276E6219F249D0417C1A90EB45BE5F498331CD1E8B7C8EE7DE441A710

Function 00007FF8A7D7C1D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strspn.MSVCRT ref: 00007FF8A7D7C1FC
strspn.MSVCRT ref: 00007FF8A7D7C245
strchr.MSVCRT ref: 00007FF8A7D7C25D
memcpy.MSVCRT ref: 00007FF8A7D7C28C

Strings

, xrefs: 00007FF8A7D7C1EF, 00007FF8A7D7C23B
ambisonic , xrefs: 00007FF8A7D7C1D7

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strspn$memcpystrchr
String ID: $ambisonic
API String ID: 2918080867-3257024572
Opcode ID: 0f5482def2ad202852d1b32bcf54bb77238b5e8d6a621b367dc68f81b01bffa8
Instruction ID: dc61103daa7d5e79446ff43e1327ec627b6c63ee40c44149b1c3e67231523d38
Opcode Fuzzy Hash: 0f5482def2ad202852d1b32bcf54bb77238b5e8d6a621b367dc68f81b01bffa8
Instruction Fuzzy Hash: C4312C33B0A542A5EA209F6599543BD3799EF49BD4F488632ED2D47389DE3CD151E300

Function 00007FF8A7D60D30 Relevance: 12.2, APIs: 8, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D60E09
memcpy.MSVCRT ref: 00007FF8A7D60E31
memcpy.MSVCRT ref: 00007FF8A7D60E64
_aligned_free.MSVCRT ref: 00007FF8A7D60EFD
_aligned_free.MSVCRT ref: 00007FF8A7D60F22
_aligned_free.MSVCRT ref: 00007FF8A7D60F2B
_aligned_free.MSVCRT ref: 00007FF8A7D60F34
_aligned_free.MSVCRT ref: 00007FF8A7D60F3C

Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60AA6
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60ADD
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60AFA
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60B03
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60B0C
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60B14
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60B1D
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60B27
Part of subcall function 00007FF8A7D609B0: _aligned_free.MSVCRT ref: 00007FF8A7D60B31

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free$memcpy
String ID:
API String ID: 2399556850-0
Opcode ID: 3c9d650dbb13996a3ec22da08a15398705cb45436fe499cb8ebfbe706efbcf1e
Instruction ID: b3e6c494ce3b22c83c44f61847f39262bba928813b5976decbf70ad0993fcb18
Opcode Fuzzy Hash: 3c9d650dbb13996a3ec22da08a15398705cb45436fe499cb8ebfbe706efbcf1e
Instruction Fuzzy Hash: DE51D526B2B65596EA50CF15E444B7D67A0FB88BC4F084635FE5E07B99DF3CE441A300

Function 00007FF8A7E0BC90 Relevance: 12.1, APIs: 8, Instructions: 89timethreadCOMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF8A7E0BCBD
QueryPerformanceCounter.KERNEL32 ref: 00007FF8A7E0BCD0
GetCurrentThread.KERNEL32 ref: 00007FF8A7E0BD39
GetThreadTimes.KERNEL32 ref: 00007FF8A7E0BD5B
GetCurrentProcess.KERNEL32 ref: 00007FF8A7E0BDA8
GetProcessTimes.KERNEL32 ref: 00007FF8A7E0BDCA
_errno.MSVCRT ref: 00007FF8A7E0BDD4
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A7E0BDF5

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: d139243207ebbece3588048b73cc12c1a18ec046571d34b62e2ee2edf8e95ea4
Instruction ID: dd676133da851c4689465b446b4253732cb69f83522fb2b069dfc7915067bd23
Opcode Fuzzy Hash: d139243207ebbece3588048b73cc12c1a18ec046571d34b62e2ee2edf8e95ea4
Instruction Fuzzy Hash: 8531E3B2B19A8692EF548F25E81017EA365FB80BC4F109136EA8E47B68DF3CD515DB00

Function 00007FF8A7D81C90 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 85stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D81D24

Strings

rgba, xrefs: 00007FF8A7D81CD3
rgb32, xrefs: 00007FF8A7D81C9A
%s%s, xrefs: 00007FF8A7D81D63
bgra, xrefs: 00007FF8A7D81D40
yuv420p, xrefs: 00007FF8A7D81CE5, 00007FF8A7D81D74
bgr32, xrefs: 00007FF8A7D81CC3

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: %s%s$bgr32$bgra$rgb32$rgba$yuv420p
API String ID: 1004003707-3566121812
Opcode ID: 98d685d57b4154a566717737cbd7b33df6296256410a4f9ae653ec1de5376476
Instruction ID: 161a23e5d96ebff4cb45158e4fd63f16671f5c3c220fc1de65057b547d447f31
Opcode Fuzzy Hash: 98d685d57b4154a566717737cbd7b33df6296256410a4f9ae653ec1de5376476
Instruction Fuzzy Hash: 5D316B21F0A50275FF609F1299107BD1359EF50BC4F4C023ADE2E1B298EE6DE519E380

Function 00007FF8A7D56810 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226COMMON

Download Yara Rule

Strings

tail_len <= 5, xrefs: 00007FF8A7D569FD
src/libavutil/avstring.c, xrefs: 00007FF8A7D569F6
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D56A0D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: Assertion %s failed at %s:%d$src/libavutil/avstring.c$tail_len <= 5
API String ID: 0-789252298
Opcode ID: 329d394584cb3486badaf9e4265f6a7098fb55d9a784c86af4291aec6c9427e0
Instruction ID: 108c4b2ddadea581bdc7c3b8706023123f4ade2defcce79a69759a8ca82b68ea
Opcode Fuzzy Hash: 329d394584cb3486badaf9e4265f6a7098fb55d9a784c86af4291aec6c9427e0
Instruction Fuzzy Hash: F9710673A0B6C263EA624E24652077D6591FB05FE4F44A332DE3D067C8ED7DA580E600

Function 00007FF8A7D6AF20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

Invalid mapping found when attempting unmap., xrefs: 00007FF8A7D6B0F6
Failed to map frame into derived frame context: %d., xrefs: 00007FF8A7D6B1DD
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D6B12C
src/libavutil/hwcontext.c, xrefs: 00007FF8A7D6B115
orig_dst_frames == ((void *)0) || orig_dst_frames == dst->hw_frames_ctx, xrefs: 00007FF8A7D6B11C

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: Assertion %s failed at %s:%d$Failed to map frame into derived frame context: %d.$Invalid mapping found when attempting unmap.$orig_dst_frames == ((void *)0) || orig_dst_frames == dst->hw_frames_ctx$src/libavutil/hwcontext.c
API String ID: 0-1886799933
Opcode ID: 7de98eef6f36daff8acd38367cc58669d168e51f435deb3ddf0eda039419a1c9
Instruction ID: 6be846cd3e878c769489a6b54e596fcacd427521c28d7e4df4ad463d1f2550ec
Opcode Fuzzy Hash: 7de98eef6f36daff8acd38367cc58669d168e51f435deb3ddf0eda039419a1c9
Instruction Fuzzy Hash: 5D71B272A2A646A1EB60DF16D840B6E27A0FB44BD4F544236FE6D47398EF3CE441E740

Function 00007FF8A7D7535D Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
trace, xrefs: 00007FF8A7D7535D
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $trace
API String ID: 895318938-1090435506
Opcode ID: 3a7e4ea2ce39469d736bb449845fd121ad088e9476b66ab627605bef7bb8b932
Instruction ID: fb00dbd81de3e55944679bb91526effbfcafc64f749dd06c19a5b9acd64dcae6
Opcode Fuzzy Hash: 3a7e4ea2ce39469d736bb449845fd121ad088e9476b66ab627605bef7bb8b932
Instruction Fuzzy Hash: 0D61B471D0A7CAA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D75366 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
debug, xrefs: 00007FF8A7D75366
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $debug
API String ID: 895318938-486550452
Opcode ID: ca6cd3af04bd65ff9df01a8aa6ed36bed15bcb452fe8f5dd11deeb11099c855e
Instruction ID: 5968cf87e92550a1960f2cdd5195f2c5da2478aa5b4c0128a16a8fcd2300a031
Opcode Fuzzy Hash: ca6cd3af04bd65ff9df01a8aa6ed36bed15bcb452fe8f5dd11deeb11099c855e
Instruction Fuzzy Hash: A361B471D0A7CAA5EB609F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D75339 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
fatal, xrefs: 00007FF8A7D75339
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $fatal
API String ID: 895318938-1232420508
Opcode ID: e43060acaf70824709399effa99a617178f79ba8015f1816a65e9df156666156
Instruction ID: b90cbe5af821250eab53dff30a4878f1187d8a107756e2002522b057d80ea6f9
Opcode Fuzzy Hash: e43060acaf70824709399effa99a617178f79ba8015f1816a65e9df156666156
Instruction Fuzzy Hash: FC61B37190A78AA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE2DE414E781

Function 00007FF8A7D75342 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
verbose, xrefs: 00007FF8A7D75342
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $verbose
API String ID: 895318938-125437466
Opcode ID: 111cff4ae6d6aba25a1bf3a452fafae3e172758b0fbde44d0ea9f4480844efc2
Instruction ID: fe40434ad588515fadba62ea97e892a5eb9fd7c19f2dc54306ef7831e1c6a8d1
Opcode Fuzzy Hash: 111cff4ae6d6aba25a1bf3a452fafae3e172758b0fbde44d0ea9f4480844efc2
Instruction Fuzzy Hash: 0E61B471D0A7CAA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D7534B Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
info, xrefs: 00007FF8A7D7534B
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $info
API String ID: 895318938-3747654419
Opcode ID: 1be4c7bd4cf85f2f8b6acf3c87bb03881b465a4d7c3eb98ae2da582cd249990e
Instruction ID: b34fa49f0ec6b6912d1276237edcfef11c45139baf791e2ff897e1f11894d374
Opcode Fuzzy Hash: 1be4c7bd4cf85f2f8b6acf3c87bb03881b465a4d7c3eb98ae2da582cd249990e
Instruction Fuzzy Hash: F961B471D0A7CAA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D75354 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
warning, xrefs: 00007FF8A7D75354
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $warning
API String ID: 895318938-1705345410
Opcode ID: b34cf2a9aa40cf4703508ede8532485c6d2ea4047648aeaf1220a8223c5c525f
Instruction ID: b533a672570f5c7a29e5f5139909ee61b0f66624e2810f2096d856e27b5e2a04
Opcode Fuzzy Hash: b34cf2a9aa40cf4703508ede8532485c6d2ea4047648aeaf1220a8223c5c525f
Instruction Fuzzy Hash: 1061B471D0A7CAA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D75327 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
panic, xrefs: 00007FF8A7D75327
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $panic
API String ID: 895318938-4009946497
Opcode ID: 0b1fd8db72d8f79bd2880fc2ae61cae8c81ef59cf9502c5cc70fc41dd9ef4533
Instruction ID: c1bc6ef2551d6d0fe4d394a287099812aef58f5947ffaf5e8c6c58221c4d173b
Opcode Fuzzy Hash: 0b1fd8db72d8f79bd2880fc2ae61cae8c81ef59cf9502c5cc70fc41dd9ef4533
Instruction Fuzzy Hash: 6E61B471D0A7CAA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D75330 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D74F79
strcpy.MSVCRT ref: 00007FF8A7D74FC5
strlen.MSVCRT ref: 00007FF8A7D752C6

Strings

?, xrefs: 00007FF8A7D750A8
error, xrefs: 00007FF8A7D75330
%s%s%s%s, xrefs: 00007FF8A7D74F2A
[%s] , xrefs: 00007FF8A7D75316
Last message repeated %d times, xrefs: 00007FF8A7D74FA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: Last message repeated %d times$%s%s%s%s$?$[%s] $error
API String ID: 895318938-746115170
Opcode ID: 57478434a447384fa94a03ff1bade18b8ff03ea6d8e4a2e89f8b75d2d60d4bc3
Instruction ID: 5f477568df6d5cfa3b0371a744a41b31ff8983ddc79fd5433953a5bd4d51c120
Opcode Fuzzy Hash: 57478434a447384fa94a03ff1bade18b8ff03ea6d8e4a2e89f8b75d2d60d4bc3
Instruction Fuzzy Hash: 3C61B471D0A7CAA5EB608F11A4103FE7B91EF82BC4F804536DA9D1728ADE3DE414E781

Function 00007FF8A7D5AD20 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D5AD79

Strings

AMBI, xrefs: 00007FF8A7D5AD2A
U, xrefs: 00007FF8A7D5ADC0
S, xrefs: 00007FF8A7D5ADC6
R, xrefs: 00007FF8A7D5ADD4

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: AMBI$R$S$U
API String ID: 1004003707-1923686996
Opcode ID: 2c03c1ff48f72caf1a01bafe690d171ef4b5263fdc57e4468dab7bf39da5722a
Instruction ID: 79efbb31bf7f332d20b7575ebcc2005067895517ad4a688b4d04ba7cfea30355
Opcode Fuzzy Hash: 2c03c1ff48f72caf1a01bafe690d171ef4b5263fdc57e4468dab7bf39da5722a
Instruction Fuzzy Hash: 6321D623A0B49376FB219E24A8113BE1A50EB817E9F8C6672DF1D0A5D4FD7CD985E304

Function 00007FF8A7D71880 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D7191C

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7D71951
((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth, xrefs: 00007FF8A7D71975
((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth, xrefs: 00007FF8A7D71945
src/libavutil/imgutils.c, xrefs: 00007FF8A7D71936, 00007FF8A7D71966

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: memcpy
String ID: ((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth$((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth$Assertion %s failed at %s:%d$src/libavutil/imgutils.c
API String ID: 3510742995-1436408019
Opcode ID: 29eedba0b8a561808ce1373c0d83b9e424659025d8d80de6197fb189af70282f
Instruction ID: a47199e2348b6d86435fff538469ebddeea943768d2d333964ef14854732c665
Opcode Fuzzy Hash: 29eedba0b8a561808ce1373c0d83b9e424659025d8d80de6197fb189af70282f
Instruction Fuzzy Hash: 5621F8B3F0B65565FA219F11BD002AE6256FB88BD4F484336DD5C06799FF3CE1429600

Function 00007FF8A7D7D160 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65COMMON

Download Yara Rule

Strings

Unable to parse option value "%s" as boolean, xrefs: 00007FF8A7D7D3A8
true,y,yes,enable,enabled,on, xrefs: 00007FF8A7D7D2C8
false,n,no,disable,disabled,off, xrefs: 00007FF8A7D7D326
auto, xrefs: 00007FF8A7D7D169

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: Unable to parse option value "%s" as boolean$auto$false,n,no,disable,disabled,off$true,y,yes,enable,enabled,on
API String ID: 0-3796170252
Opcode ID: 80dcf72f5eaf96136f939c22b2c5b1b32456b8058e2967939369524f2b68426d
Instruction ID: e42b9625c34dbea94ada86a0c4e7086ca3256c677b298a66f9b9fc3a76cc5134
Opcode Fuzzy Hash: 80dcf72f5eaf96136f939c22b2c5b1b32456b8058e2967939369524f2b68426d
Instruction Fuzzy Hash: 7921C626E0BA4265FB42AF20A41037E5255EF81BE8F544732DC2D272D9EF3CE596B304

Function 00007FF8A7D66860 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D66C25

Part of subcall function 00007FF8A7DF9860: strlen.MSVCRT ref: 00007FF8A7DF9878
Part of subcall function 00007FF8A7DF9860: _errno.MSVCRT ref: 00007FF8A7DF9897

_errno.MSVCRT ref: 00007FF8A7D66C93

Strings

/tmp/%sXXXXXX, xrefs: 00007FF8A7D66C49
ff_tempfile: Cannot allocate file name, xrefs: 00007FF8A7D66CD6
./%sXXXXXX, xrefs: 00007FF8A7D66C77
ff_tempfile: Cannot open temporary file %s, xrefs: 00007FF8A7D66CA2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errnostrlen
String ID: ./%sXXXXXX$/tmp/%sXXXXXX$ff_tempfile: Cannot allocate file name$ff_tempfile: Cannot open temporary file %s
API String ID: 860928405-2152079688
Opcode ID: 0f688c71126fc59946a20c54ec96a80db71b419569075c9b5168e78452e7bea4
Instruction ID: 3b6c917e6bf1e9fa22d0732f68fcfe651c2f92f536b399e9c4d467f633e4d698
Opcode Fuzzy Hash: 0f688c71126fc59946a20c54ec96a80db71b419569075c9b5168e78452e7bea4
Instruction Fuzzy Hash: 2521C272A1AA06A1EA40EF21E4151BE7360FF84BD4F844632FE6D87395EE3CE004E740

Function 00007FF8A7D71990 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8A7D719F9
abort.MSVCRT ref: 00007FF8A7D71A3F

Strings

Assertion %s failed at %s:%d, xrefs: 00007FF8A7D71A2F
((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth, xrefs: 00007FF8A7D71A53
((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth, xrefs: 00007FF8A7D71A23
src/libavutil/imgutils.c, xrefs: 00007FF8A7D71A14, 00007FF8A7D71A44

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abortmemcpy
String ID: ((dst_linesize) >= 0 ? (dst_linesize) : (-(dst_linesize))) >= bytewidth$((src_linesize) >= 0 ? (src_linesize) : (-(src_linesize))) >= bytewidth$Assertion %s failed at %s:%d$src/libavutil/imgutils.c
API String ID: 985927305-1436408019
Opcode ID: 57f52b22eac4459bf228b66986decd4f74425c1849e3cd511780a932ceefaf11
Instruction ID: 2efb7974f87711a39d8815ea6db15d92fdc7ba3de084432f2ea1e4cfd49fdf28
Opcode Fuzzy Hash: 57f52b22eac4459bf228b66986decd4f74425c1849e3cd511780a932ceefaf11
Instruction Fuzzy Hash: 09110632E1B96261EB20DF54AA01BBD6790EF897C0F880739DD5C06B96FE3CE5019700

Function 00007FF65EE12370 Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

avcodec_free_context.AVCODEC-60 ref: 00007FF65EE12388
avformat_free_context.AVFORMAT-60 ref: 00007FF65EE123CC

Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1204A
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12065
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE12080
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE1209B
Part of subcall function 00007FF65EE12030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF65EE123A2), ref: 00007FF65EE120B6

av_free.AVUTIL-58 ref: 00007FF65EE123B1
avio_context_free.AVFORMAT-60 ref: 00007FF65EE123BD
avio_close.AVFORMAT-60 ref: 00007FF65EE123C4
avcodec_free_context.AVCODEC-60 ref: 00007FF65EE12402
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF65EE12415

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strncmp$avcodec_free_context$av_freeavformat_free_contextavio_closeavio_context_freefree
String ID:
API String ID: 1086289117-0
Opcode ID: 5750c0e3cd2fb8260dfd87b4c22098c1e8e3cbc363b4994d39577057d30215b3
Instruction ID: 9ad081c867046b22534cdb320f082341168fd164275201841fd5d73dde8f3889
Opcode Fuzzy Hash: 5750c0e3cd2fb8260dfd87b4c22098c1e8e3cbc363b4994d39577057d30215b3
Instruction Fuzzy Hash: 00216522A24662C2EF14DFA5E95037C6360FF58F44F496536FA4D97649CF78D4929300

Function 00007FF8A7E0A660 Relevance: 10.6, APIs: 7, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7E09840: TlsGetValue.KERNEL32 ref: 00007FF8A7E0985D

longjmp.MSVCRT ref: 00007FF8A7E0A69B
TlsGetValue.KERNEL32 ref: 00007FF8A7E0A6A7
CloseHandle.KERNEL32 ref: 00007FF8A7E0A6D3
_endthreadex.MSVCRT ref: 00007FF8A7E0A6EB
CloseHandle.KERNEL32 ref: 00007FF8A7E0A6FD
TlsSetValue.KERNEL32 ref: 00007FF8A7E0A71B
CloseHandle.KERNEL32 ref: 00007FF8A7E0A72E

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 73060f70dbe4c489cd31e19d1776919e8e936670c78b2bffbe7749b2f46d11de
Instruction ID: ed30dd3ba5b947758c83545e59e7f6f301ba3d16e8120251e7158837f735fda8
Opcode Fuzzy Hash: 73060f70dbe4c489cd31e19d1776919e8e936670c78b2bffbe7749b2f46d11de
Instruction Fuzzy Hash: F5211635A0B686A6E6959F21E45877E76B4EF44F84F058135CE0A07390DF7CA865E700

Function 00007FF8A7D5D810 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D5D85F

Strings

src/libavutil/crc.c, xrefs: 00007FF8A7D5D834, 00007FF8A7D5D894
av_crc_init(av_crc_table[AV_CRC_32_IEEE_LE], 1, 32, 0xEDB88320, sizeof(av_crc_table[AV_CRC_32_IEEE_LE])) >= 0, xrefs: 00007FF8A7D5D83B
av_crc_init(av_crc_table[AV_CRC_16_ANSI_LE], 1, 16, 0xA001, sizeof(av_crc_table[AV_CRC_16_ANSI_LE])) >= 0, xrefs: 00007FF8A7D5D89B
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D5D84B, 00007FF8A7D5D8AB

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$av_crc_init(av_crc_table[AV_CRC_16_ANSI_LE], 1, 16, 0xA001, sizeof(av_crc_table[AV_CRC_16_ANSI_LE])) >= 0$av_crc_init(av_crc_table[AV_CRC_32_IEEE_LE], 1, 32, 0xEDB88320, sizeof(av_crc_table[AV_CRC_32_IEEE_LE])) >= 0$src/libavutil/crc.c
API String ID: 4206212132-3869419772
Opcode ID: 96f5f185df5af9d250496bea1b812434c02eec593cc3f23363683570a2ddd386
Instruction ID: 1d9802cc27f1273ed3ea2f7728db8feb88f52819cc26627da04b9be8ca4a79dc
Opcode Fuzzy Hash: 96f5f185df5af9d250496bea1b812434c02eec593cc3f23363683570a2ddd386
Instruction Fuzzy Hash: 52115231F0B986A1E610AF60A8023FD2B54EF95784FC04275D94D467A5EE3CE115E724

Function 00007FF8A7D78E40 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D78F33

Strings

%lld:%02d:%02d.%06d, xrefs: 00007FF8A7D78FE4
INT64_MIN, xrefs: 00007FF8A7D79056
%d.%06d, xrefs: 00007FF8A7D7907B
INT64_MAX, xrefs: 00007FF8A7D7901B
%d:%02d.%06d, xrefs: 00007FF8A7D78EE2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strlen
String ID: %d.%06d$%d:%02d.%06d$%lld:%02d:%02d.%06d$INT64_MAX$INT64_MIN
API String ID: 39653677-2240581584
Opcode ID: cf4f16006c1c0a862bb4f663b07b40e742fc65853bf7fc4d11485ba963f2ff38
Instruction ID: 6f53e11399eb0b2e1da2eb2bdb6c45b737a4385a7cb719cd44b6cdee13bb8292
Opcode Fuzzy Hash: cf4f16006c1c0a862bb4f663b07b40e742fc65853bf7fc4d11485ba963f2ff38
Instruction Fuzzy Hash: 1C413CD1B1A78956EE74CF2658063BD9582DB94FC0F848332DE2E677D9DE3CA104A240

Function 00007FF8BFAB1920 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFAB5530: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF8BFAB1688), ref: 00007FF8BFAB5552

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB1980
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB19DE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB1A07
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB1A1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFAB1A73
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFAB1A86

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno$free
String ID:
API String ID: 4247730083-0
Opcode ID: 34b5fe769a158e21acccb4ad1b5a9f683f14a6e55ea9ebd6d8c1efb0b3076924
Instruction ID: e7c718bfb9ce83c147a48c956c4b6eca8587f008f89eb648c6f9f409e87e026f
Opcode Fuzzy Hash: 34b5fe769a158e21acccb4ad1b5a9f683f14a6e55ea9ebd6d8c1efb0b3076924
Instruction Fuzzy Hash: C0518F32A18F4396E6189BA9E54227827A4BF447D8F402135DB5D436E7EF3CF865C340

Function 00007FF8BFAB3AB0 Relevance: 9.1, APIs: 6, Instructions: 66threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8BFAB3B29
GetCurrentProcess.KERNEL32 ref: 00007FF8BFAB3B35
GetCurrentThread.KERNEL32 ref: 00007FF8BFAB3B3E
GetCurrentProcess.KERNEL32 ref: 00007FF8BFAB3B47
DuplicateHandle.KERNEL32 ref: 00007FF8BFAB3B6C

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Current$ProcessThread$DuplicateHandle
String ID:
API String ID: 4285418203-0
Opcode ID: 122369a1c330d7f29e53f35644df85b62e1c336a8a69c3fc79a39b0e983c8277
Instruction ID: d709f025f2ac4d43f96d36e15f91d5a73f100e416cecdf20e61ff9ad06912a9f
Opcode Fuzzy Hash: 122369a1c330d7f29e53f35644df85b62e1c336a8a69c3fc79a39b0e983c8277
Instruction Fuzzy Hash: 7B317431908FC18AE7249F69E8422AAB7A0FF587C8F146134DF8D06B56DF3CE1958700

Function 00007FF8BFAB5C10 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF8BFAB5C22
OpenProcess.KERNEL32 ref: 00007FF8BFAB5C36
GetLastError.KERNEL32 ref: 00007FF8BFAB5C41
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB5C57
CloseHandle.KERNEL32 ref: 00007FF8BFAB5C72
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB5C7C

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Process_errno$CloseCurrentErrorHandleLastOpen
String ID:
API String ID: 3861255796-0
Opcode ID: e8f9237df677979dc71b34d724e04c16cd4c67e5f51f945e8c435fea502eb581
Instruction ID: fbc8492c3603ac9e83fa3c7c62103ddd9c7ce459552cb120432492e4dc114615
Opcode Fuzzy Hash: e8f9237df677979dc71b34d724e04c16cd4c67e5f51f945e8c435fea502eb581
Instruction Fuzzy Hash: D7015621B08E4242EB595BADB4852295361EF8D7D8F456134DB2E477D6DE3CD8814704

Function 00007FF8A7D58250 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 196stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D5828B
strftime.MSVCRT ref: 00007FF8A7D5832A

Strings

[truncated strftime output], xrefs: 00007FF8A7D5840E, 00007FF8A7D58421, 00007FF8A7D584F1

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strftimestrlen
String ID: [truncated strftime output]
API String ID: 1668665056-4273287863
Opcode ID: 48fee134cde3df212bc8b5240acc974637bc91c92b5dcb55f0befaaa1fd8cc70
Instruction ID: ec7de0985c6a4413ebd63dabf10c370d41e9e266086a987bb66b0f155e1fb0f3
Opcode Fuzzy Hash: 48fee134cde3df212bc8b5240acc974637bc91c92b5dcb55f0befaaa1fd8cc70
Instruction Fuzzy Hash: 3B71E572B076915BE714CE29D88863D2391EB48BD0F559335DE2A933C8EE3CE846E300

Function 00007FF8A7D713C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF8A7D715FB
_aligned_free.MSVCRT ref: 00007FF8A7D71633

Strings

Picture size %ux%u is invalid, xrefs: 00007FF8A7D71649
Formats with a palette require a minimum alignment of 4, xrefs: 00007FF8A7D71604

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_freememset
String ID: Formats with a palette require a minimum alignment of 4$Picture size %ux%u is invalid
API String ID: 4139559148-2772728507
Opcode ID: d2bce35dc7bea88bc8b002da499a7abb22af52d3ac8cced75f3b84996035a56c
Instruction ID: 528525bea8ae624c461ececfb49116aad403ae2863a2c133c6cc74a6afe9dcad
Opcode Fuzzy Hash: d2bce35dc7bea88bc8b002da499a7abb22af52d3ac8cced75f3b84996035a56c
Instruction Fuzzy Hash: 1F61F162B0A68266EB048F25990476E6792FFC5BD4F44C339DE6E477DCEE3EE4009600

Function 00007FF8A7D91850 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 172COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D91AF8

Part of subcall function 00007FF8A7E0AF60: CreateEventA.KERNEL32 ref: 00007FF8A7E0AFE2
Part of subcall function 00007FF8A7E0AF60: Sleep.KERNEL32 ref: 00007FF8A7E0AFF7

Strings

src/libavutil/slicethread.c, xrefs: 00007FF8A7D91ACD
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D91AE4
nb_threads >= 0, xrefs: 00007FF8A7D91AD4
j, xrefs: 00007FF8A7D91AEB

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CreateEventSleepabort
String ID: Assertion %s failed at %s:%d$j$nb_threads >= 0$src/libavutil/slicethread.c
API String ID: 723382662-4085466978
Opcode ID: 0dd97ee1e1389a45ab9eeccc6ffecfb3266947cce79cf5f2d17546453878bf81
Instruction ID: 1ec22777cf21c1df4feed4e9950d12c1306baeed50cfd37d5eb2a55b69895abc
Opcode Fuzzy Hash: 0dd97ee1e1389a45ab9eeccc6ffecfb3266947cce79cf5f2d17546453878bf81
Instruction Fuzzy Hash: C271C432A0AB82A6E7249F21D5403AE73A1FB847C4F044635DEAD47B89DF3DE461E741

Function 00007FF8A7DFD620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7DFD6C0
_errno.MSVCRT ref: 00007FF8A7DFD710

Strings

exp, xrefs: 00007FF8A7DFD6E6, 00007FF8A7DFD72B, 00007FF8A7DFD765

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: exp
API String ID: 2918714741-113136155
Opcode ID: e90ec1942e2a92b2f1d0ed0121cc3710e2463ace097223b5873384d11cd1195e
Instruction ID: ccaa7b1ca54aadb265f231e1d907beb287337f8c920e7d01754e56f5d6d7f8b2
Opcode Fuzzy Hash: e90ec1942e2a92b2f1d0ed0121cc3710e2463ace097223b5873384d11cd1195e
Instruction Fuzzy Hash: E7512952D0DA85A2E7025F34E81227F6320FF96788F50D331E6CD3459AFF6DE5A1AA40

Function 00007FF8A7D59750 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

src/libavutil/buffer.c, xrefs: 00007FF8A7D598C9
pool->alloc || pool->alloc2, xrefs: 00007FF8A7D598D0
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D598E6

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID: Assertion %s failed at %s:%d$pool->alloc || pool->alloc2$src/libavutil/buffer.c
API String ID: 0-4265094632
Opcode ID: d76ba869af0c935bc261349364afef7ac018e203dbb1c970f62eb4bb728a1136
Instruction ID: c85d901b86aee4176789ca014b7cd1d34ec1f77805c900a7b1d6b0ac59d2d586
Opcode Fuzzy Hash: d76ba869af0c935bc261349364afef7ac018e203dbb1c970f62eb4bb728a1136
Instruction Fuzzy Hash: 3F515772606B81A2EB509F11E4887AE37A8FB48BC9F455235DEAD07394DF3CE454D380

Function 00007FF8A7D76510 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D766C3

Strings

in_ts != ((int64_t)0x8000000000000000ULL), xrefs: 00007FF8A7D766A7
duration >= 0, xrefs: 00007FF8A7D766D7
src/libavutil/mathematics.c, xrefs: 00007FF8A7D76698, 00007FF8A7D766C8
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D766B3

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$duration >= 0$in_ts != ((int64_t)0x8000000000000000ULL)$src/libavutil/mathematics.c
API String ID: 4206212132-3367517387
Opcode ID: 513caed045a4db0526df902e940f6b02687e0721ee3627fbbd4727eb2fb21fc4
Instruction ID: a220ad75fe4174db1dc8ad879fddbcbfd2662f9849824d0c0496ac1694597c68
Opcode Fuzzy Hash: 513caed045a4db0526df902e940f6b02687e0721ee3627fbbd4727eb2fb21fc4
Instruction Fuzzy Hash: E141EA72B0AB8590EA20DF41F9547AEA764FB84BD0F844136EE4D07B99EE7CE141D700

Function 00007FF8A7D961E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D962C2

Strings

dual_stride <= basis, xrefs: 00007FF8A7D96321
!dual_stride || !(dual_stride & (dual_stride - 1)), xrefs: 00007FF8A7D962A6
src/libavutil/tx.c, xrefs: 00007FF8A7D96297, 00007FF8A7D96312
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D962B2

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: !dual_stride || !(dual_stride & (dual_stride - 1))$Assertion %s failed at %s:%d$dual_stride <= basis$src/libavutil/tx.c
API String ID: 4206212132-1907613106
Opcode ID: b2d68d41104b27e6dcc2f546f5ee05c62e4ee261660e14a4176fa03e21371bc5
Instruction ID: 76d2e4f359c098cf09a80f0dce5f0e4a657978bf0648c027183b93a92f2bd0b3
Opcode Fuzzy Hash: b2d68d41104b27e6dcc2f546f5ee05c62e4ee261660e14a4176fa03e21371bc5
Instruction Fuzzy Hash: F031E872A0A685A6E7608F11A4407AF7660FB487D4F544235EEAD03F58DF3CE054DB40

Function 00007FF8A7D7E750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D7E792

Strings

none, xrefs: 00007FF8A7D7E755
ntsc, xrefs: 00007FF8A7D7E76B

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: none$ntsc
API String ID: 1004003707-2486863473
Opcode ID: 6b738e6fadc790c156b69ca33ae2bb0c185686464ba8ef256ca71794a6c641fc
Instruction ID: f31a7390618ad34bc55fd922b968fde6c3f53bde82c2d0a92b0f4d9f45657c92
Opcode Fuzzy Hash: 6b738e6fadc790c156b69ca33ae2bb0c185686464ba8ef256ca71794a6c641fc
Instruction Fuzzy Hash: 3811D372F0A15165EB218F29E8447BE6790EB44BE8F484131EE5C8B398DE3CE591E340

Function 00007FF8A7E09780 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8A7E097D6
_ultoa.MSVCRT ref: 00007FF8A7E097E9
OutputDebugStringA.KERNEL32 ref: 00007FF8A7E0982D
abort.MSVCRT ref: 00007FF8A7E09833

Strings

Error cleaning up spin_keys for thread , xrefs: 00007FF8A7E097BE

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cleaning up spin_keys for thread
API String ID: 4191895893-2906507043
Opcode ID: 81378f2af0811eeb7f04898ebd31de8b15f56f487cc7d9f9e4b7e3e7059bb688
Instruction ID: d873822dbcf524e0b567c479fa3da214c0494a13529d3681aa6fb5e3e92ca4ef
Opcode Fuzzy Hash: 81378f2af0811eeb7f04898ebd31de8b15f56f487cc7d9f9e4b7e3e7059bb688
Instruction Fuzzy Hash: D211E2B2B0E682A1FB644F24E41837D1691EF86BE1F984730DA5C4A7D4DE2CEC5AD311

Function 00007FF8BFAB2780 Relevance: 7.7, APIs: 5, Instructions: 200synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8BFAB2829

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 128c7c0c7c4041ad80a73ece8c7e6e0e6db133071bd0854d49eb70ad7e1cdf79
Instruction ID: a4823367606b52ddd40bf2a32ccc56a7bb79db44261a902e98051456d8cee3df
Opcode Fuzzy Hash: 128c7c0c7c4041ad80a73ece8c7e6e0e6db133071bd0854d49eb70ad7e1cdf79
Instruction Fuzzy Hash: 9491A822918E4346E73B4BAC941237A73E0BF857E8F546236CB6D466D6EF3CE4428740

Function 00007FF8A7E078B0 Relevance: 7.7, APIs: 5, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8A7E07957

Part of subcall function 00007FF8A7E08840: WaitForMultipleObjects.KERNEL32 ref: 00007FF8A7E088B4

ResetEvent.KERNEL32 ref: 00007FF8A7E07917
WaitForSingleObject.KERNEL32 ref: 00007FF8A7E07998

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Wait$ObjectSingle$EventMultipleObjectsReset
String ID:
API String ID: 654736092-0
Opcode ID: 34fbc9e2f4b500ec35d71564d19f70a292e06c702ea4cefd25497b8e02179aaa
Instruction ID: b7c9a855f58a6853ac27746c6a4f179e77f0d9a2fd23356579b4d3e3e4f4008b
Opcode Fuzzy Hash: 34fbc9e2f4b500ec35d71564d19f70a292e06c702ea4cefd25497b8e02179aaa
Instruction Fuzzy Hash: 8B514831F8E50361FEA15A2A940537F0292FF90FDAF994531D94E862D1ED6CA9B3A201

Function 00007FF8A7E08970 Relevance: 7.6, APIs: 5, Instructions: 102threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8A7E089B0

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 64ab8e10bfe97489d8a8b5c547ce0e4a8904eff289fa1a41a4582324bccb7b1a
Instruction ID: 6570a40eb0d70f6ae58390ff6fe689de3f52f8d7b0a1ef91fbaa8d12dbf057c1
Opcode Fuzzy Hash: 64ab8e10bfe97489d8a8b5c547ce0e4a8904eff289fa1a41a4582324bccb7b1a
Instruction Fuzzy Hash: B1310833B4659296FB569F28D94872E2294EF40BE0F844535DF0C86A80EE3CEC92E741

Function 00007FF8A7D7A167 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8A7D799A4

Strings

%-15s , xrefs: 00007FF8A7D799B0
false, xrefs: 00007FF8A7D7A180
true, xrefs: 00007FF8A7D7A179
auto, xrefs: 00007FF8A7D7A16A

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strcmp
String ID: %-15s $auto$false$true
API String ID: 1004003707-1025821387
Opcode ID: fb3527bd10113371e98a9a1ec61775ec9984070070ae132d8b4dc0cee117fe9d
Instruction ID: 34f45bd970e81b3bd4b90ebee44541aa9e21f0033cf0ab27b69379823aa44d18
Opcode Fuzzy Hash: fb3527bd10113371e98a9a1ec61775ec9984070070ae132d8b4dc0cee117fe9d
Instruction Fuzzy Hash: 08315032A0B642AAEB609F11A2413FE2365FF40BC1F445136DA6D47699DF3CF460E780

Function 00007FF8A7E07400 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A7E07418
ReleaseSemaphore.KERNEL32 ref: 00007FF8A7E07446
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7E07453
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7E07473
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7E07498

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: f1a7a2740e80d1d3259fae1787131c9bb634157a3b26bf56fc66d50a79331669
Instruction ID: 26fbce89fe8708d63bf7db2c87d4407900fa129886ac193ca16d121848ce7d28
Opcode Fuzzy Hash: f1a7a2740e80d1d3259fae1787131c9bb634157a3b26bf56fc66d50a79331669
Instruction Fuzzy Hash: 9D01F123F1621A93EB458F2ABC912699280FF99BE6F849636CD0E42750DD3C9DC2D300

Function 00007FF8BFAB5BA0 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF8BFAB5BAC
OpenProcess.KERNEL32 ref: 00007FF8BFAB5BC0
GetLastError.KERNEL32 ref: 00007FF8BFAB5BCB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB5BE1
CloseHandle.KERNEL32 ref: 00007FF8BFAB5BF7

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpen_errno
String ID:
API String ID: 202612177-0
Opcode ID: 59d5a97e427603bb888d026b8b2610f650cbaf0f5f7bb9ca25a91e49a38cba3c
Instruction ID: bbd6010243615727c3e6b8635d41e39141534dcae90205f1cf898979c307e146
Opcode Fuzzy Hash: 59d5a97e427603bb888d026b8b2610f650cbaf0f5f7bb9ca25a91e49a38cba3c
Instruction Fuzzy Hash: FAF01260F09E0747FB2C5BED94963346391AF4C799F446438CB2E867D2EE2C68D68710

Function 00007FF8A7D64910 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 306stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D6494B
_aligned_free.MSVCRT ref: 00007FF8A7D64E0E

Strings

d, xrefs: 00007FF8A7D649CB
Invalid chars '%s' at the end of expression '%s', xrefs: 00007FF8A7D64A7D

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_freestrlen
String ID: Invalid chars '%s' at the end of expression '%s'$d
API String ID: 1887580107-3215087449
Opcode ID: 5a1976bc1fae1619cc5837e51ad9f9ceb58bf78b7d192d9c0debe48df1a25819
Instruction ID: 847f11fe04e46f375a423ad9b595dc8eff9df235f4476fef95241daf600de1c0
Opcode Fuzzy Hash: 5a1976bc1fae1619cc5837e51ad9f9ceb58bf78b7d192d9c0debe48df1a25819
Instruction Fuzzy Hash: CBE16E2661AA4691DA10DF1AE49026EAB70FFC5BD0F100232FB9D477AAEF3DE445D740

Function 00007FF8A7D915C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D91747

Strings

src/libavutil/slicethread.c, xrefs: 00007FF8A7D9171C
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D91733
nb_jobs > 0, xrefs: 00007FF8A7D91723

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$nb_jobs > 0$src/libavutil/slicethread.c
API String ID: 4206212132-1031856425
Opcode ID: 6ee0518d565bae88eeec7544e1c0ff8f03f36ef7bb88ca07a7aea4a2878acd5c
Instruction ID: 4a788dbdf0d405a005f63fbe3e94187e6f6abcfaa2ec4ebf83c271aa0743e9c8
Opcode Fuzzy Hash: 6ee0518d565bae88eeec7544e1c0ff8f03f36ef7bb88ca07a7aea4a2878acd5c
Instruction Fuzzy Hash: A141C637B06A41A6EB24DF29E44066EB7A1FB84BD8F588139CE5D03A54DF3DE442D740

Function 00007FF8A7D55FB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D55FC9
strspn.MSVCRT ref: 00007FF8A7D56030
strspn.MSVCRT ref: 00007FF8A7D560B6

Strings

, xrefs: 00007FF8A7D55FEA, 00007FF8A7D560A3

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strspn$strlen
String ID:
API String ID: 697951671-596783616
Opcode ID: c2f3e75c8f79a9c271b989593eea45416c26161b9ab45691b9c7843e23effee5
Instruction ID: ed392ba2f7b3045d2d6a0368e1033e310a42b60406f9d241aa3da1e2f072e7b2
Opcode Fuzzy Hash: c2f3e75c8f79a9c271b989593eea45416c26161b9ab45691b9c7843e23effee5
Instruction Fuzzy Hash: D2319411A0F2D262EE554F199A2027E5BA2EF05FC8F485671EE6D1B389CE2DF452E300

Function 00007FF8A7D78990 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00007FF8A7D78A4A

Strings

Unable to parse option value "%s" as %s, xrefs: 00007FF8A7D78A79
none, xrefs: 00007FF8A7D789B2
Value %d for parameter '%s' out of %s format range [%d - %d], xrefs: 00007FF8A7D78ADA

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strtol
String ID: Unable to parse option value "%s" as %s$Value %d for parameter '%s' out of %s format range [%d - %d]$none
API String ID: 76114499-2908652078
Opcode ID: 3dc9da589c42dd02856a593b1258d03a0b292f87372d4db75a7a8f83acead3ae
Instruction ID: 0af2cf0bdef650d57ec915c6e3bed148f4201224c223d3f477f89706b781b272
Opcode Fuzzy Hash: 3dc9da589c42dd02856a593b1258d03a0b292f87372d4db75a7a8f83acead3ae
Instruction Fuzzy Hash: 6B311832B0EA8265E7619F35690076E6351EB817E4F508332ED6D636D8DF3CE4819700

Function 00007FF65EE12990 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

avformat_new_stream.AVFORMAT-60(?,?,?,00007FF65EE112F1), ref: 00007FF65EE129AD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00007FF65EE112F1), ref: 00007FF65EE129C0
fprintf.MSPDB140-MSVCRT ref: 00007FF65EE129D3

Part of subcall function 00007FF65EE12320: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FF65EE129D8,?,?,?,00007FF65EE112F1), ref: 00007FF65EE12357

Strings

Couldn't create stream for encoder '%s', xrefs: 00007FF65EE129C9

Memory Dump Source

Source File: 00000007.00000002.2294622948.00007FF65EE11000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF65EE10000, based on PE: true

Associated: 00000007.00000002.2294598232.00007FF65EE10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294667462.00007FF65EE15000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294698930.00007FF65EE16000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.2294724582.00007FF65EE19000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff65ee10000_obs-ffmpeg-mux.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintfavformat_new_streamfprintf
String ID: Couldn't create stream for encoder '%s'
API String ID: 306180413-3485626053
Opcode ID: 97d36ac62344db8522675eb32487dc47749b1acbad2880230df25e82e6eb689d
Instruction ID: c18e08f7737bdc28e6db2fd1359f855a1bd753eb6e20e1a6e30ed8289a0f6885
Opcode Fuzzy Hash: 97d36ac62344db8522675eb32487dc47749b1acbad2880230df25e82e6eb689d
Instruction Fuzzy Hash: 74F06D32B29B9181EE48CB56F951069A7A1FB9CBD0B48D035FE4D53719DE3CD592CB00

Function 00007FF8A7D6D880 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00007FF8A7D6D8AF

Strings

Disabling use of CUDA primary device context, xrefs: 00007FF8A7D6D8B8
Using CUDA primary device context, xrefs: 00007FF8A7D6D8E0
primary_ctx, xrefs: 00007FF8A7D6D889

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strtol
String ID: Disabling use of CUDA primary device context$Using CUDA primary device context$primary_ctx
API String ID: 76114499-1919470267
Opcode ID: 3c091e27e2dbc98c8e65e12db3f15324b02cb9e40d48561a3b36329f0690444e
Instruction ID: 2ba027a6312772d813f36fafce51d831a6e3fb58b5d242203d4eaf0e287c2e26
Opcode Fuzzy Hash: 3c091e27e2dbc98c8e65e12db3f15324b02cb9e40d48561a3b36329f0690444e
Instruction Fuzzy Hash: 07F09021F1B20260FA54BF66A4167BD1300EF96BD4F846932EC2D0A7E6DD2CA040E340

Function 00007FF8A7D59960 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D599A4

Strings

buf, xrefs: 00007FF8A7D59980
src/libavutil/buffer.c, xrefs: 00007FF8A7D59979
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D59990

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$buf$src/libavutil/buffer.c
API String ID: 4206212132-2693306993
Opcode ID: 6a1729c8ae82779914f64dfb9c10cf82327e2bfa5a8fbcb130779104fee64848
Instruction ID: 348486c795470bb18440f727c04e0ec0658c4baefa529870d7ec3e117e4e7aef
Opcode Fuzzy Hash: 6a1729c8ae82779914f64dfb9c10cf82327e2bfa5a8fbcb130779104fee64848
Instruction Fuzzy Hash: E3E06D71B0AB46A1EA14AF65E40119D27A0EF88F84F948136DA4C073B4DF3CE111D714

Function 00007FF8A7D77500 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D7752F

Strings

src/libavutil/mem.c, xrefs: 00007FF8A7D77504
val || !min_size, xrefs: 00007FF8A7D7750F
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D77516

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$src/libavutil/mem.c$val || !min_size
API String ID: 4206212132-3343232236
Opcode ID: 9f2d832eee8a386a6791954090d46eb0d2479cb7aefd3148675639f8814a35ca
Instruction ID: ce8901a1647605514dbf1a85281a2ed776f87d640f122caf08f7856298604bad
Opcode Fuzzy Hash: 9f2d832eee8a386a6791954090d46eb0d2479cb7aefd3148675639f8814a35ca
Instruction Fuzzy Hash: 17E08CB194BB42A0EB50EF50A8013FD3760FF59784FC44236D44E16AA4EF3CA125D660

Function 00007FF8A7D655A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 12COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D655CF

Strings

cur_size >= size, xrefs: 00007FF8A7D655AF
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D655B6
src/libavutil/fifo.c, xrefs: 00007FF8A7D655A4

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$cur_size >= size$src/libavutil/fifo.c
API String ID: 4206212132-2007657860
Opcode ID: 88a5e5efd281f7ab3c7b4b2a72e72c85cd5da5ff7f8b021ecd333fd393f9dcb8
Instruction ID: fb23950b1e5fbc2a6679ac492234ac62a9e0a7e2eb1b11bba23f78abdd315c09
Opcode Fuzzy Hash: 88a5e5efd281f7ab3c7b4b2a72e72c85cd5da5ff7f8b021ecd333fd393f9dcb8
Instruction Fuzzy Hash: F0D0C231A0A942A0E300EF1094022FC27A0FB48780F814532E04D03260CF3CE115D710

Function 00007FF8BFAB3BE0 Relevance: 6.1, APIs: 4, Instructions: 126synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8BFAB3C3E
ResetEvent.KERNEL32 ref: 00007FF8BFAB3C8E
WaitForSingleObject.KERNEL32 ref: 00007FF8BFAB3D0F

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: ObjectSingleWait$EventReset
String ID:
API String ID: 466820088-0
Opcode ID: 23d1a419ce0311e38330c9e7fff77312c1ba9e2a20c5924deb88d3609af00be2
Instruction ID: 574fb24ad15de5cb9e7ab4379bbbd77c9c51b2f695eac9d5474c3850dcc91e0e
Opcode Fuzzy Hash: 23d1a419ce0311e38330c9e7fff77312c1ba9e2a20c5924deb88d3609af00be2
Instruction Fuzzy Hash: D7416532A08B4186EB59DF69E4422AD7361FB84BCCF485035DB4D4768ADF3CE555CB40

Function 00007FF8A7D51010 Relevance: 6.1, APIs: 4, Instructions: 124sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF8A7D5105D
_amsg_exit.MSVCRT ref: 00007FF8A7D51086

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 3224bf86eb5cef696b33d2aba6a83138660028b8981cd15249a10f7ce29e597b
Instruction ID: 0ea5004a9421fa1e502b7161173fc19ffb7cae0b81b25b25eb167024677acf28
Opcode Fuzzy Hash: 3224bf86eb5cef696b33d2aba6a83138660028b8981cd15249a10f7ce29e597b
Instruction Fuzzy Hash: 9641B032E0B582A6F6128F2AE85077D23A5EF44BC4F54517ACE1D47398DE3EE891B310

Function 00007FF8A7D566B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D566D8
strchr.MSVCRT ref: 00007FF8A7D5670F
strlen.MSVCRT ref: 00007FF8A7D567FB

Strings

ALL, xrefs: 00007FF8A7D566F8

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strlen$strchr
String ID: ALL
API String ID: 3013107155-2914988887
Opcode ID: fcefe4586e90ed2a4975fb323870bf9105dc7dc9ba43fdb0f7cef785815bcb23
Instruction ID: dbc8ab178fdd47f32dc39d19c9bb474ae40697e09225764540632a0be6a78876
Opcode Fuzzy Hash: fcefe4586e90ed2a4975fb323870bf9105dc7dc9ba43fdb0f7cef785815bcb23
Instruction Fuzzy Hash: 11313B57B0B0A122FF65CD316A34B7D4AA29F45BC0F486630CD6907E89DE6C9896A300

Function 00007FF8BFAB1CF0 Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFAB1D5C
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB1DDB
ResumeThread.KERNEL32 ref: 00007FF8BFAB1E0A

Part of subcall function 00007FF8BFAB56D0: CloseHandle.KERNEL32 ref: 00007FF8BFAB5775
Part of subcall function 00007FF8BFAB56D0: CloseHandle.KERNEL32 ref: 00007FF8BFAB5785

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFAB1E42

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CloseHandle$ResumeThread_beginthreadexfreemalloc
String ID:
API String ID: 1141387253-0
Opcode ID: 66f779a04675420d10c3e0e1a40261c3780ffcd5451449fc6e1faf9f36e06287
Instruction ID: dc818b10f9cd4fb0ac89dccc8893b49b6fec6a060f3bece547f26b8fecbba3c8
Opcode Fuzzy Hash: 66f779a04675420d10c3e0e1a40261c3780ffcd5451449fc6e1faf9f36e06287
Instruction Fuzzy Hash: 8741AF32A08F8186E7699F59A4412BAB7A0FB98B98F54A134EF8D03755EF3CE541C740

Function 00007FF8BFAB1AE0 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ed3023e85355d8c7d662a5ea9ebd51d1dc57e461f8a813a7e81e918f6af5b3
Instruction ID: f6d046bced06893fd8023a3040a5898bb31b6bc7282ead6e79c2df2747187854
Opcode Fuzzy Hash: a5ed3023e85355d8c7d662a5ea9ebd51d1dc57e461f8a813a7e81e918f6af5b3
Instruction Fuzzy Hash: 14414B72A08F4286EB19DB99E84223967A5FF84BD8B546435CF0D43396EF3CE856C740

Function 00007FF8BFAB1790 Relevance: 6.1, APIs: 4, Instructions: 96threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

SuspendThread.KERNEL32 ref: 00007FF8BFAB1845
WaitForSingleObject.KERNEL32 ref: 00007FF8BFAB1850
ResumeThread.KERNEL32 ref: 00007FF8BFAB188E

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Thread$ObjectResumeSingleSuspendWait
String ID:
API String ID: 879609812-0
Opcode ID: e0952a9e7b9d2dd58eff9cf88d52fd7236f715f562f819b9b31cf785f32f6f21
Instruction ID: aad02688b7c4e7b48e43b8a5f338542ea022bc79fc03d689489454146c940a0f
Opcode Fuzzy Hash: e0952a9e7b9d2dd58eff9cf88d52fd7236f715f562f819b9b31cf785f32f6f21
Instruction Fuzzy Hash: 6A41743290898586E7258FA9D4423BD63A1FF94BDCF546031DB4D47686DF3CE985CB40

Function 00007FF8A7E06900 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF8A7E0695A
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7E0699A

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 1a996603528365f6f637cd234a293156ba757802906f7287cb03bbb997d6b298
Instruction ID: 2bad63f18332b925d00d2a0fe191808433099ff6a4fd92d506bf3c5ff35ddbf1
Opcode Fuzzy Hash: 1a996603528365f6f637cd234a293156ba757802906f7287cb03bbb997d6b298
Instruction Fuzzy Hash: 0331F672A4D28186E3618F28F42036D77A0FB84BC4F948231DAD847BC5DF3DD5A29B00

Function 00007FF8A7E0BF60 Relevance: 6.1, APIs: 4, Instructions: 84timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A7E0BF93
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A7E0BFF9
_errno.MSVCRT ref: 00007FF8A7E0C056
_errno.MSVCRT ref: 00007FF8A7E0C083

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: 49a1365162b2beb6e2a3ccfb8f5b0d34ed3bda1431d8c2c1350c42e5770df44f
Instruction ID: 501137d9330dcb1bcaa494c136d01ee3b771de2f164e0fb39b9565232add03b0
Opcode Fuzzy Hash: 49a1365162b2beb6e2a3ccfb8f5b0d34ed3bda1431d8c2c1350c42e5770df44f
Instruction Fuzzy Hash: DE31A233B4A64A9AEA548F35DE0017D6292EB94FD8F588231DD0D477F4EE3CE952D200

Function 00007FF8BFAB2670 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199528771ef270659c4c603ab843dedc8cd56cbcb61e71196821b80f414cc4d2
Instruction ID: 6fbd0507cb6bfef678d2cb3138fd380c2066cc23d72fc28bee3ed27ec24ca896
Opcode Fuzzy Hash: 199528771ef270659c4c603ab843dedc8cd56cbcb61e71196821b80f414cc4d2
Instruction Fuzzy Hash: 04317E36A09F4186EB6A8F59E46112877F0FB48FC8B59903ACB4C03B45DF38E892C744

Function 00007FF8A7E0B1F0 Relevance: 6.1, APIs: 4, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00007FF8A7E0B221

Part of subcall function 00007FF8A7E09840: TlsGetValue.KERNEL32 ref: 00007FF8A7E0985D

WaitForSingleObject.KERNEL32 ref: 00007FF8A7E0B27E
CloseHandle.KERNEL32(?,?,?,-00000028,?,00007FF8A7D917F6), ref: 00007FF8A7E0B290
CloseHandle.KERNEL32(?,?,?,-00000028,?,00007FF8A7D917F6), ref: 00007FF8A7E0B29C

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleValueWait
String ID:
API String ID: 3336430066-0
Opcode ID: 549c524895db14aa5244f77738d71316e65da89358fac4c80a16bd5f07bf5018
Instruction ID: ab1f7cebcffe7383bb294f840c7d131f73a283e3a4687dc74230ffee7af558b8
Opcode Fuzzy Hash: 549c524895db14aa5244f77738d71316e65da89358fac4c80a16bd5f07bf5018
Instruction Fuzzy Hash: 34215C32B5B682A0FA519F61D8487BE6394EF44FE0F480631DE2D863D5DE2CD852E304

Function 00007FF8A7D781C0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D7822F
_aligned_malloc.MSVCRT ref: 00007FF8A7D78249
memset.MSVCRT ref: 00007FF8A7D7825C

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free_aligned_mallocmemset
String ID:
API String ID: 881591362-0
Opcode ID: cb9fa4dfdc566d95d76ac6a2519e6b12bbd1fac9c9e4a918d491552342bc60f3
Instruction ID: 1132ff21a3b4499fea92982d25973356d17f1bce2c9ae50355bdf8e1169aca86
Opcode Fuzzy Hash: cb9fa4dfdc566d95d76ac6a2519e6b12bbd1fac9c9e4a918d491552342bc60f3
Instruction Fuzzy Hash: A1219FB2B0AB4196FB515F65FA0036C63D1EB58BD5F488230CE6D23798EE7C59859300

Function 00007FF8A7D82150 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8A7D82184

Part of subcall function 00007FF8A7D55DA0: strlen.MSVCRT ref: 00007FF8A7D55DF3

strlen.MSVCRT ref: 00007FF8A7D821AC
strcmp.MSVCRT ref: 00007FF8A7D821FC

Part of subcall function 00007FF8A7D566B0: strlen.MSVCRT ref: 00007FF8A7D566D8
Part of subcall function 00007FF8A7D566B0: strchr.MSVCRT ref: 00007FF8A7D5670F

Strings

yuv420p, xrefs: 00007FF8A7D821DA

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strlen$strchrstrcmp
String ID: yuv420p
API String ID: 3490844034-503634524
Opcode ID: 633ea0c1e1550fd14e7121fbcdf51e94ec169c277e73b1c36fc1efad037321a4
Instruction ID: 8dc36250da63199f7d2476435c6a33a1696c71988dc6a744fbb300f719e5efeb
Opcode Fuzzy Hash: 633ea0c1e1550fd14e7121fbcdf51e94ec169c277e73b1c36fc1efad037321a4
Instruction Fuzzy Hash: 86213661E0E18231FF258E20A41573D97A0EF22BC4F884332CA2E066D8DE6CF591E305

Function 00007FF8BFAB5E70 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF8BFAB1B64,?,?,?,?,?,00000002,00000000,00007FF8BFAB4983), ref: 00007FF8BFAB5F1E

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 96d3de31802f6f9abf018a6055aabe2c4eb702216a45d5bc26d38f291c6951f2
Instruction ID: 9cb1521f21eaa95fc267d288aea0eb55d694d75ac045925c7100a4352af79138
Opcode Fuzzy Hash: 96d3de31802f6f9abf018a6055aabe2c4eb702216a45d5bc26d38f291c6951f2
Instruction Fuzzy Hash: 50219232A08F4286F368DF69E441129B3A1EB887D8F546131DB5D43B9AEF3CE8028710

Function 00007FF8A7D605F0 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_aligned_free.MSVCRT ref: 00007FF8A7D60678
_aligned_free.MSVCRT ref: 00007FF8A7D60682
_aligned_free.MSVCRT ref: 00007FF8A7D6068C
_aligned_free.MSVCRT ref: 00007FF8A7D60697

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_free
String ID:
API String ID: 2229574080-0
Opcode ID: d8a117b9735c8cceecb487bba0c084549c0ddfc89fe5e4f491a561c101f37a0f
Instruction ID: cb9efde2f1a9eb750afd0aa638b619faea197a2efc777920dd70d62a42f97063
Opcode Fuzzy Hash: d8a117b9735c8cceecb487bba0c084549c0ddfc89fe5e4f491a561c101f37a0f
Instruction Fuzzy Hash: 6A110A22F1770223E955AF099449B7E129AEF887E0F000B35DE5D0B386DE38DC40D380

Function 00007FF8BFAB58A0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFAB58C5

Part of subcall function 00007FF8BFAB3E30: TlsSetValue.KERNEL32 ref: 00007FF8BFAB3F19

_endthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB5929
_endthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAB594E

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _endthreadex$Valuefree
String ID:
API String ID: 1763976194-0
Opcode ID: ad5126445cb35a49f1ec9a11fd8a50259baa29f677a2b30741e53d48839e9ca9
Instruction ID: 7b708ce0f738c212b445034b11356fd03f346b3f1f2fad459ab3222d343ff0a1
Opcode Fuzzy Hash: ad5126445cb35a49f1ec9a11fd8a50259baa29f677a2b30741e53d48839e9ca9
Instruction Fuzzy Hash: FC214F36604F0286DB149F6DE89116D7364FB88BA8B242235DF6E473A6DF3DD896C700

Function 00007FF8BFAB5CF0 Relevance: 6.1, APIs: 4, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF8BFAB1BA8,?,?,?,?,?,00000002,00000000,00007FF8BFAB4983), ref: 00007FF8BFAB5D3C

Part of subcall function 00007FF8BFAB2F10: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,00000018,00007FF8BFAB25B8), ref: 00007FF8BFAB2FFF

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF8BFAB1BA8,?,?,?,?,?,00000002,00000000,00007FF8BFAB4983), ref: 00007FF8BFAB5D54
Sleep.KERNEL32(?,?,?,00007FF8BFAB1BA8,?,?,?,?,?,00000002,00000000,00007FF8BFAB4983), ref: 00007FF8BFAB5D92
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8BFAB1BA8,?,?,?,?,?,00000002,00000000,00007FF8BFAB4983), ref: 00007FF8BFAB5DA9

Memory Dump Source

Source File: 00000007.00000002.2301259236.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000007.00000002.2301134546.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301373372.00007FF8BFAB8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301404788.00007FF8BFAB9000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.2301429850.00007FF8BFABC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8bfab0000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CloseEventHandleSleep_errnofree
String ID:
API String ID: 1909294951-0
Opcode ID: fb46983425866d5872816068a530570fbf95f67e655fb18db1a897369a563da2
Instruction ID: 16089c0a818669f6ae9d1fac51722cf358e21893fbfd9a45d0bc1bd6f536e98d
Opcode Fuzzy Hash: fb46983425866d5872816068a530570fbf95f67e655fb18db1a897369a563da2
Instruction Fuzzy Hash: 5A116331609E4386EB28DFA9E45627A63A0EF447C8F546531D75E47AE7DF3CE4428700

Function 00007FF8A7DFD8E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7DFD960
_errno.MSVCRT ref: 00007FF8A7DFD9C0

Strings

log, xrefs: 00007FF8A7DFD97C, 00007FF8A7DFD9DC

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: log
API String ID: 2918714741-2403297477
Opcode ID: fa12abfb3e14b30e677fb45da5cfe9a9bbeb6b1c1569a3c707cd0e3862981db9
Instruction ID: 39db70e4288b22292b48a8025666c7839310a7aa017feed5a93aa972146b436a
Opcode Fuzzy Hash: fa12abfb3e14b30e677fb45da5cfe9a9bbeb6b1c1569a3c707cd0e3862981db9
Instruction Fuzzy Hash: 5D210632D1EB4692E7029F34A45027F6721FFD5B88F509338E69D05699DF6DE0A1AB00

Function 00007FF8A7DFD4E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7DFD55C

Strings

cos, xrefs: 00007FF8A7DFD56A, 00007FF8A7DFD5BC

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: cos
API String ID: 2918714741-2662988677
Opcode ID: 903857df638d29162f1127ec14efd8d82056fcd9a594b0710213474096d9e04a
Instruction ID: c0e8beb2ad6221bc11137eb839fff04e7ad51c766e3ea9fe80710d116ab1392c
Opcode Fuzzy Hash: 903857df638d29162f1127ec14efd8d82056fcd9a594b0710213474096d9e04a
Instruction Fuzzy Hash: D6212F62D1EB8682EB029F38A40027F6321FFD2348F149334FAD91569ADF6DE0E59700

Function 00007FF8A7DFE120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8A7DFE19C

Strings

sin, xrefs: 00007FF8A7DFE1AA, 00007FF8A7DFE1FC

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _errno
String ID: sin
API String ID: 2918714741-3083047850
Opcode ID: 1712686245d460706722795bac48a202a04de283def8482a719af71ef36c7ef1
Instruction ID: 78687ce15dbb7ef510f38e82fe69d564589c4829eca5da46205f8b96cfa0a952
Opcode Fuzzy Hash: 1712686245d460706722795bac48a202a04de283def8482a719af71ef36c7ef1
Instruction Fuzzy Hash: 65210072D0EB8592EB028F39A40127F6321EFD1348F109334FA991559ADF6DE0E19B10

Function 00007FF8A7D5FFF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59stringCOMMON

Download Yara Rule

APIs

strftime.MSVCRT ref: 00007FF8A7D60061

Strings

.%06dZ, xrefs: 00007FF8A7D60092
%Y-%m-%dT%H:%M:%S, xrefs: 00007FF8A7D60057

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: strftime
String ID: %Y-%m-%dT%H:%M:%S$.%06dZ
API String ID: 1100141660-930656424
Opcode ID: 6197a247b2b8d8ceb3bdce396f44f74d54b797a4093b4ad4865344da7c3ecd53
Instruction ID: 466bf317f283d3626d212195203d15edc93ec61cc37b45fd650820f53045aac2
Opcode Fuzzy Hash: 6197a247b2b8d8ceb3bdce396f44f74d54b797a4093b4ad4865344da7c3ecd53
Instruction Fuzzy Hash: 1111026271A64224EA519E267C01AEA5611EB49BF4F885332FD3D6B7D9DD3CE041A300

Function 00007FF8A7D77870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_aligned_malloc.MSVCRT ref: 00007FF8A7D77898

Strings

Microsoft Primitive Provider, xrefs: 00007FF8A7D77872

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: _aligned_malloc
String ID: Microsoft Primitive Provider
API String ID: 175129771-4132848957
Opcode ID: 61d24a781ba67f0d1d7f4682cf0f95fd41d5d8f035c987dadc3b785e5cf7c726
Instruction ID: e3a159b789b874825a24829edc4ad48605f8694d0cefd48aede464b55fda3d4a
Opcode Fuzzy Hash: 61d24a781ba67f0d1d7f4682cf0f95fd41d5d8f035c987dadc3b785e5cf7c726
Instruction Fuzzy Hash: DFF0BE11F0B15622FD949A93A802BB84381DF58BE4D484935DE2C5B785EC3CA882E744

Function 00007FF8A7D5DDB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF8A7D5DEE3

Strings

src/libavutil/crc.c, xrefs: 00007FF8A7D5DEB8
Assertion %s failed at %s:%d, xrefs: 00007FF8A7D5DECF

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: abort
String ID: Assertion %s failed at %s:%d$src/libavutil/crc.c
API String ID: 4206212132-3600904276
Opcode ID: bba2b5a7149953d7c06390e03a8456bfcd7d5d25b4af83ad1be5f4adfa0ba47c
Instruction ID: 0032976691081747a848e96e384391e488417eea3e7e79e6c94d5b1f56b3c924
Opcode Fuzzy Hash: bba2b5a7149953d7c06390e03a8456bfcd7d5d25b4af83ad1be5f4adfa0ba47c
Instruction Fuzzy Hash: 77E0E5B1A0B646B1E704AF50E0422FD2362EF18780F408536D14C02365CE3CE214D710

Function 00007FF8A7E07F10 Relevance: 5.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A7E07F57
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7E07F81

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: dbaf99fa4423a1f3adf368dfeb11cd1e5322a0253855be351de1d8e7fc337a2b
Instruction ID: 8b5c5bb3318c63f386ac2718d881c7339e325b27f2877738fc84facee837193f
Opcode Fuzzy Hash: dbaf99fa4423a1f3adf368dfeb11cd1e5322a0253855be351de1d8e7fc337a2b
Instruction Fuzzy Hash: 29316272B156429AEB94CF31D41076E6390FB40FACF588232DD294A784DF3CD8A6D750

Function 00007FF8A7E07DD0 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A7E07E17
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7E07E3E

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3daa023327df31125aad0ab46ab992fec0b38e9f634fe2131313756e927dbfc2
Instruction ID: f6b8e5d2c0aa1e4a85a8957c82b346113a383d35e919b9b76291a0a910922a0c
Opcode Fuzzy Hash: 3daa023327df31125aad0ab46ab992fec0b38e9f634fe2131313756e927dbfc2
Instruction Fuzzy Hash: FD317073B0A2429AEB54CF34D40026D33A1FB44F99F588635CD198A788DF3CD896DB50

Function 00007FF8A7E07B90 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00007FF8A7E07EA7,?,?,?,?,?,?,?,?,00007FF8A7D91502), ref: 00007FF8A7E07BB6
LeaveCriticalSection.KERNEL32(?,?,00007FF8A7E07EA7,?,?,?,?,?,?,?,?,00007FF8A7D91502), ref: 00007FF8A7E07BDB
EnterCriticalSection.KERNEL32(?,?,00007FF8A7E07EA7,?,?,?,?,?,?,?,?,00007FF8A7D91502), ref: 00007FF8A7E07C0C
LeaveCriticalSection.KERNEL32(?,?,00007FF8A7E07EA7,?,?,?,?,?,?,?,?,00007FF8A7D91502), ref: 00007FF8A7E07C16

Memory Dump Source

Source File: 00000007.00000002.2300563440.00007FF8A7D51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8A7D50000, based on PE: true

Associated: 00000007.00000002.2300538999.00007FF8A7D50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300657829.00007FF8A7E15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300774113.00007FF8A7E16000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300884512.00007FF8A7F53000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300948518.00007FF8A7F58000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F59000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2300972397.00007FF8A7F5C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2301026975.00007FF8A7F5D000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8a7d50000_obs-ffmpeg-mux.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3a1490edba09e3a7becc86b2e09e5672a663190b4e9fac5deeb906d35fe4d6c1
Instruction ID: 5ea8e48f79a2700d39c0d3096f739acf2391402d94469b7f2c74ab70faa7e31a
Opcode Fuzzy Hash: 3a1490edba09e3a7becc86b2e09e5672a663190b4e9fac5deeb906d35fe4d6c1
Instruction Fuzzy Hash: D801D422B0A655A9EA159B33AC40A2E5750FB98FDAF455031DD0D07300CD3CD452A740

Analysis Process: createdump.exePID: 2164, Parent PID: 6460COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	700
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF71BAA1060 Relevance: 65.0, APIs: 13, Strings: 24, Instructions: 214
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71BAA112F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71BAA115B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71BAA1187
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71BAA1230
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF71BAA123C
GetTempPathA.KERNEL32 ref: 00007FF71BAA12C1
GetLastError.KERNEL32 ref: 00007FF71BAA12CB
GetLastError.KERNEL32 ref: 00007FF71BAA12DF
strcat_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF71BAA12F8
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1350
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1359
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1364
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA136D

Strings

strcat_s failed (%d), xrefs: 00007FF71BAA1306
--withheap, xrefs: 00007FF71BAA1151
--verbose, xrefs: 00007FF71BAA1226
triage minidump, xrefs: 00007FF71BAA1247
--triage, xrefs: 00007FF71BAA117D
-, xrefs: 00007FF71BAA1110
GetTempPath failed (0x%08x), xrefs: 00007FF71BAA12D3
-, xrefs: 00007FF71BAA113C
-, xrefs: 00007FF71BAA10DC
minidump, xrefs: 00007FF71BAA1267
createdump [options] pid-f, --name - dump path and file name. The default is '%TEMP%\dump.%p.dmp'. These specifiers are substituted with following values: %p PID of dumped process. %e The process executable filename. %h Hostname return by gethostn, xrefs: 00007FF71BAA1386
v, xrefs: 00007FF71BAA121A
-, xrefs: 00007FF71BAA11D7
Dump successfully written, xrefs: 00007FF71BAA1338
--normal, xrefs: 00007FF71BAA1125
--full, xrefs: 00007FF71BAA11A8
-, xrefs: 00007FF71BAA1215
-, xrefs: 00007FF71BAA1168
dump.%p.dmp, xrefs: 00007FF71BAA12E9
full dump, xrefs: 00007FF71BAA11C3
--name, xrefs: 00007FF71BAA10B8
-, xrefs: 00007FF71BAA1194
--diag, xrefs: 00007FF71BAA11EF
minidump with heap, xrefs: 00007FF71BAA107C, 00007FF71BAA10BF

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: strcmp$ErrorLast__acrt_iob_funcfflush$PathTempatoistrcat_s
String ID: -$-$-$-$-$-$-$--diag$--full$--name$--normal$--triage$--verbose$--withheap$Dump successfully written$GetTempPath failed (0x%08x)$createdump [options] pid-f, --name - dump path and file name. The default is '%TEMP%\dump.%p.dmp'. These specifiers are substituted with following values: %p PID of dumped process. %e The process executable filename. %h Hostname return by gethostn$dump.%p.dmp$full dump$minidump$minidump with heap$strcat_s failed (%d)$triage minidump$v
API String ID: 2647627392-2367407095
Opcode ID: 3e8843d71ddd811f5735ae345386871f6517bdd5673e2455e3aa9b185965a2cd
Instruction ID: e9c01a7ce219a020f3db00d408769b56a5a66af3f7ae188c79280e7fcc60ed2d
Opcode Fuzzy Hash: 3e8843d71ddd811f5735ae345386871f6517bdd5673e2455e3aa9b185965a2cd
Instruction Fuzzy Hash: D3A16451D0CE8265FB61AF399410A79EAA4AB46FB4FC46335C94E065B5DE3CF44C83B0

Function 00007FF71BAA27EC Relevance: 13.6, APIs: 9, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF71BAA2800

Part of subcall function 00007FF71BAA2B8C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71BAA2BAE

__scrt_release_startup_lock.LIBCMT ref: 00007FF71BAA2883
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA28D1
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA28D6
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA28DE
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA28E6
__scrt_is_managed_app.LIBCMT ref: 00007FF71BAA28FA
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA2908
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA2962

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 2308368977-0
Opcode ID: 5a9b20bb9eaae0def914decdfc47a4fcc48693c8541f2657ef11ecffac799aa6
Instruction ID: 54e8fbf9333a7a78247788031cc053e69bda869134567d90cb0fdb53f608504a
Opcode Fuzzy Hash: 5a9b20bb9eaae0def914decdfc47a4fcc48693c8541f2657ef11ecffac799aa6
Instruction Fuzzy Hash: 58310B21E0CB1641FA14BB399451BB9D291AF45FA4FC47239E90D072B7DE6CE85C82F0

Function 00007FF71BAA1450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1475
fprintf.MSPDB140-MSVCRT ref: 00007FF71BAA1485

Part of subcall function 00007FF71BAA1010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1047

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1494
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14B3
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14BE
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14C7

Strings

[createdump] , xrefs: 00007FF71BAA147E

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintf$fflushfprintf
String ID: [createdump]
API String ID: 3735572767-2657508301
Opcode ID: f7b41b5d75985a22341ebafe60962d777547180dfe076665e84a48d8af4ee52e
Instruction ID: 75569e7231c1830acc4a4ea9127d985adde12519591a923ce2b35b674fd471a1
Opcode Fuzzy Hash: f7b41b5d75985a22341ebafe60962d777547180dfe076665e84a48d8af4ee52e
Instruction Fuzzy Hash: 1A018F25A08F4192E600AB65F81597AE364EF84FE0F805238DA9E03775CF3CD46DC3A0

Non-executed Functions

Function 00007FF71BAA2ECC Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71BAA2EE8
RtlCaptureContext.KERNEL32 ref: 00007FF71BAA2F15
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71BAA2F2F
RtlVirtualUnwind.KERNEL32 ref: 00007FF71BAA2F70
IsDebuggerPresent.KERNEL32 ref: 00007FF71BAA2FC4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71BAA2FE5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71BAA2FF0

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 92083fc3b2590fb7f42fdf2bff26a09e0be32edceb9cda99800bf26d983c5eac
Instruction ID: 5eae15f94dd2063a55d66c392e056557a3bf4c54d3302ce309342b74925e1ca2
Opcode Fuzzy Hash: 92083fc3b2590fb7f42fdf2bff26a09e0be32edceb9cda99800bf26d983c5eac
Instruction Fuzzy Hash: 5E316F72609F8196EB609F74E8407EEB361FB84B54F80513ADA4E57AA4EF38C54CC760

Function 00007FF71BAA23C0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF71BAA242D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF71BAA243B

Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1475
Part of subcall function 00007FF71BAA1450: fprintf.MSPDB140-MSVCRT ref: 00007FF71BAA1485
Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1494
Part of subcall function 00007FF71BAA1450: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14B3
Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14BE
Part of subcall function 00007FF71BAA1450: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14C7

K32GetModuleBaseNameA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF71BAA2466
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF71BAA2470
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF71BAA2487
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF71BAA25F3

Strings

Invalid dump path '%s' error %d, xrefs: 00007FF71BAA252C
Get process name FAILED %d, xrefs: 00007FF71BAA2478
Write dump FAILED 0x%08x, xrefs: 00007FF71BAA258E
Writing %s to file %s, xrefs: 00007FF71BAA24C3
Invalid process id '%d' error %d, xrefs: 00007FF71BAA2447

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __acrt_iob_func$ErrorLast$BaseCloseHandleModuleNameOpenProcess__stdio_common_vfprintf_invalid_parameter_noinfo_noreturnfflushfprintf
String ID: Get process name FAILED %d$Invalid dump path '%s' error %d$Invalid process id '%d' error %d$Write dump FAILED 0x%08x$Writing %s to file %s
API String ID: 3971781330-1292085346
Opcode ID: 8ec448eeb6e8f02312a1538d84a3c8dfc991fc7cafdc13e8cd0ded943aea62a7
Instruction ID: 997cc46394fd366d3c93712a78d3e61564f32426c9eda9a4936d264d6db9648f
Opcode Fuzzy Hash: 8ec448eeb6e8f02312a1538d84a3c8dfc991fc7cafdc13e8cd0ded943aea62a7
Instruction Fuzzy Hash: 59616731A08F4291E610AB29E450A7AE761FB45FB4F901234DA9E03AB5DF3DE459C7B0

Function 00007FF71BAA49A4 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 316
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71BAA4B42
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71BAA4E65
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA4E7B
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA4E93
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA4E99

Strings

csm, xrefs: 00007FF71BAA4A89
csm, xrefs: 00007FF71BAA4AEB
csm, xrefs: 00007FF71BAA4B69

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: terminate$Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 695522112-393685449
Opcode ID: b33eca4017884e99d2f222704934a1d2e619e74398d1b95ed41b8d3f9756be10
Instruction ID: 57d88fb02f4208f90b66e8beb4b7a27f1e9b7392259dbc722638f1ecb5fe78aa
Opcode Fuzzy Hash: b33eca4017884e99d2f222704934a1d2e619e74398d1b95ed41b8d3f9756be10
Instruction Fuzzy Hash: A1E1B832908E8289E710AF39D4407ADB7A0FB44F68F545235EA8D477A5DF38E549C7B0

Function 00007FF71BAA13C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA13E5
fprintf.MSPDB140-MSVCRT ref: 00007FF71BAA13F5

Part of subcall function 00007FF71BAA1010: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1047

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1404
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1423
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA142E
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1437

Strings

[createdump] , xrefs: 00007FF71BAA13EE

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintf$fflushfprintf
String ID: [createdump]
API String ID: 3735572767-2657508301
Opcode ID: 5b675bc39e039bc525fd467c26ca74d7b5bd1981a0b88a155956b168aee24ed4
Instruction ID: 054b5ddde1448e8a06055ae56fadfe6db6f29acf2e8cd2b6ac8a62e6068f6ca3
Opcode Fuzzy Hash: 5b675bc39e039bc525fd467c26ca74d7b5bd1981a0b88a155956b168aee24ed4
Instruction Fuzzy Hash: 98012C35A08F4192E600AB65F8149AAF360EB95FE1F805235DA9D037758F7CD4ADC7A0

Function 00007FF71BAA1800 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF71BAA186C

Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1475
Part of subcall function 00007FF71BAA1450: fprintf.MSPDB140-MSVCRT ref: 00007FF71BAA1485
Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1494
Part of subcall function 00007FF71BAA1450: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14B3
Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14BE
Part of subcall function 00007FF71BAA1450: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14C7

Strings

Pipe syntax in dump name not supported, xrefs: 00007FF71BAA1850
Invalid dump name format char '%c', xrefs: 00007FF71BAA1DD0
%%%%%%%%, xrefs: 00007FF71BAA1D5C
%%%%%%%%, xrefs: 00007FF71BAA1890
--name, xrefs: 00007FF71BAA180A

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __acrt_iob_func$Startup__stdio_common_vfprintffflushfprintf
String ID: %%%%%%%%$%%%%%%%%$--name$Invalid dump name format char '%c'$Pipe syntax in dump name not supported
API String ID: 3378602911-3973674938
Opcode ID: 6d691e12a95190b73438bc01f861d361a60469c0dc3d28550e2b0afd423a51ff
Instruction ID: 3c3f28b663d7a0ed2efa17f16d0dba97ed42e44fbad38891d23eadaeca332bfe
Opcode Fuzzy Hash: 6d691e12a95190b73438bc01f861d361a60469c0dc3d28550e2b0afd423a51ff
Instruction Fuzzy Hash: C831F962E08E8166E7559F2E9854BF9A751BB4ABE4FC41236DD4D033A1CE3CE049C370

Function 00007FF71BAA6498 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,?,00000000,00007FF71BAA669F,?,?,?,00007FF71BAA441E,?,?,?,00007FF71BAA43D9), ref: 00007FF71BAA651D
GetLastError.KERNEL32(?,00000000,00007FF71BAA669F,?,?,?,00007FF71BAA441E,?,?,?,00007FF71BAA43D9,?,?,?,?,00007FF71BAA3524), ref: 00007FF71BAA652B
LoadLibraryExW.KERNEL32(?,00000000,00007FF71BAA669F,?,?,?,00007FF71BAA441E,?,?,?,00007FF71BAA43D9,?,?,?,?,00007FF71BAA3524), ref: 00007FF71BAA6555
FreeLibrary.KERNEL32(?,00000000,00007FF71BAA669F,?,?,?,00007FF71BAA441E,?,?,?,00007FF71BAA43D9,?,?,?,?,00007FF71BAA3524), ref: 00007FF71BAA659B
GetProcAddress.KERNEL32(?,00000000,00007FF71BAA669F,?,?,?,00007FF71BAA441E,?,?,?,00007FF71BAA43D9,?,?,?,?,00007FF71BAA3524), ref: 00007FF71BAA65A7

Strings

api-ms-, xrefs: 00007FF71BAA653D

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 91eaabdab86b5d7484fb536d38c8d26551698fbc6984510a5f5d6d43d06b7795
Instruction ID: 29a44bb979c48ee8b5551248491109b8cda6128438a20507aa87f188d51464d5
Opcode Fuzzy Hash: 91eaabdab86b5d7484fb536d38c8d26551698fbc6984510a5f5d6d43d06b7795
Instruction Fuzzy Hash: 7031B321A09E4291EE61BB2D9800975A294FF88F70F996735ED1D467A4DF3CE04887B0

Function 00007FF71BAA1B18 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF71BAA1B1D

Strings

%%%%%%%%, xrefs: 00007FF71BAA1D5C
Could not get the host name for dump name: %d, xrefs: 00007FF71BAA1DB2

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: _time64
String ID: %%%%%%%%$Could not get the host name for dump name: %d
API String ID: 1670930206-4114407318
Opcode ID: 30f253d6cb86930f70187238c9af70fef4a32202514a54efb800f102df6d23dc
Instruction ID: f5fbdbebfd1cbe7803b8af662876d6a238a994ddc5c62194ff957a17d6bba612
Opcode Fuzzy Hash: 30f253d6cb86930f70187238c9af70fef4a32202514a54efb800f102df6d23dc
Instruction Fuzzy Hash: FB51F462A18F8156EB009F3DD450BA9A7A4EB46BE0F801235DA5D13BF5DF3CE049D3A0

Function 00007FF71BAA4EA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EncodePointer.KERNEL32 ref: 00007FF71BAA4F10
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA5189

Strings

MOC, xrefs: 00007FF71BAA4F24
RCC, xrefs: 00007FF71BAA4F2C

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: EncodePointerabort
String ID: MOC$RCC
API String ID: 1188231555-2084237596
Opcode ID: 97abe66515cb1414aeefc8003222462485e27fa84eefc4111ad6d0138f6fd2ea
Instruction ID: 89c7fbe0ef21c723264d638463366193139488a6dabbb07f416ccbf25d1af509
Opcode Fuzzy Hash: 97abe66515cb1414aeefc8003222462485e27fa84eefc4111ad6d0138f6fd2ea
Instruction Fuzzy Hash: 0691D573A04F818AE710DB78D4806ADBBA0F704B98F54523AEB8D17B64DF38D159C760

Function 00007FF71BAA5414 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71BAA543E
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA56A2

Strings

csm, xrefs: 00007FF71BAA55D2
csm, xrefs: 00007FF71BAA5463

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 1056e810e0031d83590426beccc43492b2f2866ca19cabfb7471893f0b3bcd0b
Instruction ID: 95f7819e6fe72f7d7a810742a136da6c3c134f74132056bcae6a8aba902f03e2
Opcode Fuzzy Hash: 1056e810e0031d83590426beccc43492b2f2866ca19cabfb7471893f0b3bcd0b
Instruction Fuzzy Hash: 7971D732508A828AD7246F39D050B7DBBA1FB40FA5F889235DA8D07AA5CF3CD455C7A4

Function 00007FF71BAA195F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%%%%%%%%, xrefs: 00007FF71BAA1D5C
Could not get the host name for dump name: %d, xrefs: 00007FF71BAA1DB2

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID:
String ID: %%%%%%%%$Could not get the host name for dump name: %d
API String ID: 0-4114407318
Opcode ID: 3a1402493b52144332fc7ef885a246e0bef5bb5eddb931c8bdeb75c83dbb8659
Instruction ID: 4b5b3a9d0fa2004fee1696cbe397765b692dd7dd6cbb68bbff3a8c8aad66cac8
Opcode Fuzzy Hash: 3a1402493b52144332fc7ef885a246e0bef5bb5eddb931c8bdeb75c83dbb8659
Instruction Fuzzy Hash: 3451DA32A18F8556D7109B3ED440BAAA751EB82BE0F801235DA9D17BE5CF3DE045D7A0

Function 00007FF71BAA5860 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71BAA590A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF71BAA5936

Strings

csm, xrefs: 00007FF71BAA5A36

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 08459d2de849ea082ca6f7467207d0873ef5a0572d3180cf677e49d91fe67cef
Instruction ID: f9bce86a1fb0c2ca1dec3e1392194335f2c3ab4bcb92d66742290acf4e987f6b
Opcode Fuzzy Hash: 08459d2de849ea082ca6f7467207d0873ef5a0572d3180cf677e49d91fe67cef
Instruction Fuzzy Hash: 20516332618F4186D620BB29E04066EB7B4FB88FA4F542635EB8D07B65CF7CD464CB60

Function 00007FF71BAA17E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59networkCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF71BAA17EB
WSAStartup.WS2_32 ref: 00007FF71BAA186C

Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1475
Part of subcall function 00007FF71BAA1450: fprintf.MSPDB140-MSVCRT ref: 00007FF71BAA1485
Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA1494
Part of subcall function 00007FF71BAA1450: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14B3
Part of subcall function 00007FF71BAA1450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14BE
Part of subcall function 00007FF71BAA1450: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF71BAA14C7

Strings

Pipe syntax in dump name not supported, xrefs: 00007FF71BAA1850
--name, xrefs: 00007FF71BAA180A
string too long, xrefs: 00007FF71BAA17E4

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: __acrt_iob_func$StartupXinvalid_argument__stdio_common_vfprintffflushfprintfstd::_
String ID: --name$Pipe syntax in dump name not supported$string too long
API String ID: 1412700758-3183687674
Opcode ID: 937e6b2c28cea08e1eee527b5bf6a7363096d6cc0634c1c423fcc3cad23f2144
Instruction ID: 9bef4db2a6d425670f05a2266fa7f946c610855b2ef899ccba630f56c3f2d88a
Opcode Fuzzy Hash: 937e6b2c28cea08e1eee527b5bf6a7363096d6cc0634c1c423fcc3cad23f2144
Instruction Fuzzy Hash: DE01B932A14D81A5F761AF26EC41BA6E754BB49BE4F801135DE0D06661CE3CD499C760

Function 00007FF71BAA1CE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32 ref: 00007FF71BAA1CFA
WSAGetLastError.WS2_32 ref: 00007FF71BAA1DA9

Strings

%%%%%%%%, xrefs: 00007FF71BAA1D5C
Could not get the host name for dump name: %d, xrefs: 00007FF71BAA1DB2

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: ErrorLastgethostname
String ID: %%%%%%%%$Could not get the host name for dump name: %d
API String ID: 3782448640-4114407318
Opcode ID: 320cb389b9e396755b8a5578c83a0b73153155c3fa84c5d330cc0819ada1fb95
Instruction ID: 4d52d54219450e1bd8bc5ed4eb0d63e3b931b8089ef1c65de59acda718d0c25e
Opcode Fuzzy Hash: 320cb389b9e396755b8a5578c83a0b73153155c3fa84c5d330cc0819ada1fb95
Instruction Fuzzy Hash: 3E11EB11A09A4255E644BB39A450BBAA240DF86FF4F803335D95F172F5DE3CE44A43F0

Function 00007FF71BAA4158 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF71BAA41B8

Strings

RCC, xrefs: 00007FF71BAA4168
MOC, xrefs: 00007FF71BAA4170
csm, xrefs: 00007FF71BAA4178

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: 2eecf08628838b8288b91de4d166118c23004d29b6453832f1ed38693e8fa958
Instruction ID: 82e19d9bcfc4180008a1c7d3326e8f09bfa9aa772b45e276a46ef8e82fd7fad9
Opcode Fuzzy Hash: 2eecf08628838b8288b91de4d166118c23004d29b6453832f1ed38693e8fa958
Instruction Fuzzy Hash: 47F08136908E4681E3647B79A14247CB664EF58F58F886632E70806262CF7CE4A486B1

Function 00007FF71BAA20C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(-3333333333333333,?,00000000,00007FF71BAA18EE), ref: 00007FF71BAA21E0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71BAA221E

Strings

Invalid process id '%d' error %d, xrefs: 00007FF71BAA2447

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: Invalid process id '%d' error %d
API String ID: 73155330-4244389950
Opcode ID: bba2875ca5ab07f9a8534c7e54732a79a80581b419c8ee845a73c6edf0a3127c
Instruction ID: 1ca9082e7b4a3bed4bf3401b474b6a9748d3b6da91096b07013a42961a1ca8f2
Opcode Fuzzy Hash: bba2875ca5ab07f9a8534c7e54732a79a80581b419c8ee845a73c6edf0a3127c
Instruction Fuzzy Hash: 7B310532709B9195EA10AF3995446B9E7A1EB05FE0F841732DB5D07BE5CE7CE06883B0

Function 00007FF71BAA3F84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71BAA173F), ref: 00007FF71BAA3FC8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71BAA173F), ref: 00007FF71BAA400E

Strings

csm, xrefs: 00007FF71BAA3FFB

Memory Dump Source

Source File: 00000008.00000002.2294672268.00007FF71BAA1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF71BAA0000, based on PE: true

Associated: 00000008.00000002.2294648219.00007FF71BAA0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294699710.00007FF71BAA8000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294728339.00007FF71BAAC000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2294753149.00007FF71BAAD000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff71baa0000_createdump.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 7531413fd5ba05c8efc2732aab9693bebd0b5d96e62eb0afc70bc4d0601aafd3
Instruction ID: 633da32e5e7569688e9c598ef986115121d4d9439293fac1a5eefb70006c52ee
Opcode Fuzzy Hash: 7531413fd5ba05c8efc2732aab9693bebd0b5d96e62eb0afc70bc4d0601aafd3
Instruction Fuzzy Hash: 50116D32618F4182EB119B29F440669B7E0FB88F94F585230EE8D07B68DF3CC459C750

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4c6f15.rbs

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqdh50wm.iiz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvblbacv.ofr.psm1

C:\Users\user\AppData\Local\Temp\msi9DD4.txt

C:\Users\user\AppData\Local\Temp\pss9DE7.ps1

C:\Users\user\AppData\Local\Temp\scr9DD5.ps1

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\BCUninstaller.exe

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\UnRar.exe

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-console-l1-2-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Roaming\Barsoc Quite Sols\Joas App\api-ms-win-core-handle-l1-1-0.dll

Windows Analysis Report
setup.msi

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre